theory IpcCancel_C

lemma cancelIPC_ccorres_helper:
  "ccorres dc xfdc (invs' and
         st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st)
                            \<and> blockingObject st = ep) thread
        and ko_at' ep' ep)
        {s. epptr_' s = Ptr ep}
        []
        (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP
                         else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep'))
        (\<acute>queue :== CALL ep_ptr_get_queue(\<acute>epptr);;
         \<acute>queue :== CALL tcbEPDequeue(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
          CALL ep_ptr_set_queue(\<acute>epptr,\<acute>queue);;
          IF head_C \<acute>queue = NULL THEN
              CALL endpoint_ptr_set_state(\<acute>epptr,scast EPState_Idle)
          FI)" apply (rule ccorres_from_vcg) apply (rule allI) apply (rule conseqPre) apply vcg apply (clarsimp split del: if_split) apply (frule (2) ep_blocked_in_queueD) apply (frule (1) ko_at_valid_ep' [OF _ invs_valid_objs']) apply (elim conjE) apply (frule (1) valid_ep_blockedD) apply (elim conjE) apply (frule cmap_relation_ep) apply (erule (1) cmap_relation_ko_atE) apply (intro conjI) apply (erule h_t_valid_clift) apply (rule impI) apply (rule exI) apply (rule conjI) apply (rule_tac x = \<sigma> in exI) apply (intro conjI) apply assumption+ apply (drule (2) ep_to_ep_queue) apply (simp add: tcb_queue_relation'_def) apply (clarsimp simp: typ_heap_simps cong: imp_cong split del: if_split) apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (intro impI conjI allI)
   \<comment> \<open>empty case\<close> apply clarsimp apply (frule iffD1 [OF tcb_queue_head_empty_iff [OF tcb_queue_relation'_queue_rel]]) apply (rule ballI, erule bspec) apply (erule subsetD [rotated]) apply clarsimp subgoal by simp apply (simp add: setEndpoint_def split_def) apply (rule bexI [OF _ setObject_eq]) apply (simp add: remove1_empty rf_sr_def cstate_relation_def Let_def
                        cpspace_relation_def update_ep_map_tos typ_heap_simps') apply (elim conjE) apply (intro conjI)
       \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) subgoal by (clarsimp simp: comp_def)
        \<comment> \<open>ep relation\<close> apply (rule cpspace_relation_ep_update_ep, assumption+) subgoal by (simp add: cendpoint_relation_def Let_def EPState_Idle_def) subgoal by simp
           \<comment> \<open>ntfn relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cnotification_relation_ep_queue [OF invs_sym'], assumption+) subgoal by simp apply (erule (1) map_to_ko_atI') apply (simp add: heap_to_user_data_def Let_def)
 \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) subgoal by (clarsimp simp: comp_def) subgoal by (simp add: carch_state_relation_def carch_globals_def
                              typ_heap_simps') subgoal by (simp add: cmachine_state_relation_def) subgoal by (simp add: h_t_valid_clift_Some_iff) subgoal by (simp add: objBits_simps') subgoal by (simp add: objBits_simps) apply assumption
  \<comment> \<open>non empty case\<close> apply clarsimp apply (frule tcb_queue_head_empty_iff [OF tcb_queue_relation'_queue_rel]) apply (rule ballI, erule bspec) apply (erule subsetD [rotated]) apply clarsimp apply (simp add: setEndpoint_def split_def) apply (rule bexI [OF _ setObject_eq]) apply (frule (1) st_tcb_at_h_t_valid) apply (simp add: remove1_empty rf_sr_def cstate_relation_def Let_def
                       cpspace_relation_def update_ep_map_tos typ_heap_simps') apply (elim conjE) apply (intro conjI)
      \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) subgoal by (clarsimp simp: comp_def)
       \<comment> \<open>ep relation\<close> apply (rule cpspace_relation_ep_update_ep, assumption+) apply (simp add: cendpoint_relation_def Let_def isSendEP_def isRecvEP_def split: endpoint.splits split del: if_split)
           \<comment> \<open>recv case\<close> apply (clarsimp simp add: Ptr_ptr_val h_t_valid_clift_Some_iff
              tcb_queue_relation'_next_mask tcb_queue_relation'_prev_mask cong: tcb_queue_relation'_cong) subgoal by (intro impI conjI; simp)
           \<comment> \<open>send case\<close> apply (clarsimp simp add: Ptr_ptr_val h_t_valid_clift_Some_iff
             tcb_queue_relation'_next_mask tcb_queue_relation'_prev_mask cong: tcb_queue_relation'_cong) subgoal by (intro impI conjI; simp) subgoal by simp
                \<comment> \<open>ntfn relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cnotification_relation_ep_queue [OF invs_sym'], assumption+) apply simp apply (erule (1) map_to_ko_atI')
         \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) subgoal by (clarsimp simp: comp_def) subgoal by (simp add: carch_state_relation_def carch_globals_def
                             typ_heap_simps') subgoal by (simp add: cmachine_state_relation_def) subgoal by (simp add: h_t_valid_clift_Some_iff) subgoal by (simp add: objBits_simps') subgoal by (simp add: objBits_simps) apply assumption done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread and ko_at' ep' ep) \<lbrace>\<acute>epptr = ep_Ptr ep\<rbrace> [] (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep')) (\<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI) proof (prove)
goal (1 subgoal):
 1. \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread and ko_at' ep' ep) \<sigma> \<and> s \<in> \<lbrace>\<acute>epptr = ep_Ptr ep\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. \<Gamma>\<turnstile> {s. (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread and ko_at' ep' ep) \<sigma> \<and> s \<in> \<lbrace>\<acute>epptr = ep_Ptr ep\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)} proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma>. \<Gamma>\<turnstile> (?P'4 \<sigma>) \<acute>queue :== CALL ep_ptr_get_queue_'proc(\<acute>epptr);;
\<acute>queue :== CALL tcbEPDequeue_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>queue);;
CALL ep_ptr_set_queue_'proc(\<acute>epptr,\<acute>queue);;
IF head_C \<acute>queue = NULL THEN
  CALL endpoint_ptr_set_state_'proc(\<acute>epptr,SCAST(32 signed \<rightarrow> 32) EPState_Idle)
FI {s. \<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>\<sigma>. {s. (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread and ko_at' ep' ep) \<sigma> \<and> s \<in> \<lbrace>\<acute>epptr = ep_Ptr ep\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> ?P'4 \<sigma> proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. {s. (invs' and st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread and ko_at' ep' ep) \<sigma> \<and> s \<in> \<lbrace>\<acute>epptr = ep_Ptr ep\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c epptr_' s \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (epptr_' s))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (epptr_' s))))) \<longrightarrow> (\<exists>queue. (\<exists>ta. (ta, tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) s)) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb ta) \<and> distinct queue \<and> ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread) \<in> set queue \<and> ep_queue_relation' (cslift s) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (epptr_' s)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (epptr_' s))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (epptr_' s)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (epptr_' s)))))) \<and> ep_queue_relation' (cslift t) (Lib.delete (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread)) queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals s))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<longrightarrow> s \<Turnstile>\<^sub>c epptr_' s \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift s (epptr_' s)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (epptr_' s)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (epptr_' s)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (epptr_' s) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (epptr_' s)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c epptr_' s \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (epptr_' s)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (epptr_' s) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). (\<sigma>', s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>))))) \<and> ((if tcbEPPrev_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift s (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift s (epptr_' s)))))) \<noteq> NULL \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). (\<sigma>', s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>))))))))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; thread \<in> set (epQueue ep') \<and> (isSendEP ep' \<or> isRecvEP ep')\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; thread \<in> set (epQueue ep') \<and> (isSendEP ep' \<or> isRecvEP ep'); valid_ep' ep' \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> [] \<and> (\<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>) \<and> distinct (epQueue ep')\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep')\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) \<longrightarrow> (\<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<exists>queue. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queue. tcb_at' tcb t) \<and> distinct queue \<and> thread \<in> set queue \<and> ep_queue_relation' (cslift x) queue (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread queue) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set queue)\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue117 \<sigma> x ko'). tcb_at' tcb t) \<and> distinct (?queue117 \<sigma> x ko') \<and> thread \<in> set (?queue117 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue117 \<sigma> x ko') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (?queue117 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue117 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue117 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue117 \<sigma> x ko'). tcb_at' tcb t) \<and> distinct (?queue117 \<sigma> x ko') \<and> thread \<in> set (?queue117 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue117 \<sigma> x ko') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (?queue117 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue117 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue117 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (?queue117 \<sigma> x ko'). tcb_at' tcb \<sigma>) \<and> distinct (?queue117 \<sigma> x ko') \<and> thread \<in> set (?queue117 \<sigma> x ko') \<and> ep_queue_relation' (cslift x) (?queue117 \<sigma> x ko') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (?queue117 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue117 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue117 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>tcb\<in>set (?queue117 \<sigma> x ko'). tcb_at' tcb \<sigma>
 3. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> distinct (?queue117 \<sigma> x ko')
 4. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> thread \<in> set (?queue117 \<sigma> x ko')
 5. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (?queue117 \<sigma> x ko') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 6. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (?queue117 \<sigma> x ko')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue117 \<sigma> x ko'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (?queue117 \<sigma> x ko'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (epQueue ep') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (epQueue ep')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))); ep_queue_relation' (cslift x) (epQueue ep') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift x) (epQueue ep') (tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (epQueue ep')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (ep_Ptr ep))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr ep)))))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<and> ep_queue_relation' (cslift t) (remove1 thread (epQueue ep')) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals t)) = zero_ranges_are_zero rs (t_hrs_' (globals x))) \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>ta. (\<exists>ep'. endpoint_lift ep' = endpoint_lift (the (cslift x (ep_Ptr ep)))\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr ep) ep') (t_hrs_' (globals t))) \<longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> ta \<Turnstile>\<^sub>c ep_Ptr ep \<and> (\<forall>tb. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift ta (ep_Ptr ep)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL \<longrightarrow> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))) \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) \<and> ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; \<exists>endpoint. endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr> \<and> t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tc)\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> \<forall>td\<in>set (remove1 thread (epQueue ep')). tcb_at' td (?s168 \<sigma> x ko' t ta tb ep'a tc endpoint)
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint td. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); td \<in> set (remove1 thread (epQueue ep'))\<rbrakk> \<Longrightarrow> td \<in> set (epQueue ep')
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint td. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> set (remove1 thread (epQueue ep')) \<subseteq> set (epQueue ep')
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> NULL = NULL
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rbrakk> \<Longrightarrow> NULL = NULL
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; (\<sigma>_, x_) \<in> rf_sr; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)))\<rbrakk> \<Longrightarrow> NULL = NULL proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) NULL (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ep Structures_H.endpoint.IdleEP \<sigma>). (snd xa, x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep \<mapsto> injectKOS Structures_H.endpoint.IdleEP)\<rparr>), x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift ta)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta)) \<and> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift ta)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta)) \<and> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift ta = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>_; cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift ta_ = map_option tcb_null_queue_ptrs \<circ> cslift x_ proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint Structures_H.endpoint.IdleEP))) ((cslift x)(ep_Ptr ep \<mapsto> endpoint)) ep_Ptr (cendpoint_relation (cslift ta))
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift ta) Structures_H.endpoint.IdleEP endpoint
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>_; cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift ta_) Structures_H.endpoint.IdleEP endpoint_ proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>_; cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_ntfns (ksPSpace \<sigma>) p = Some a; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift ta) a' b'
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift ta) a b
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr240 \<sigma> x ko' t ta tb ep'a tc endpoint p a a' b b') \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 10. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>_; cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; a'_ = a_; map_to_ntfns (ksPSpace \<sigma>_) p_ = Some a_; b'_ = b_; cslift x_ (ntfn_Ptr p_) = Some b_\<rbrakk> \<Longrightarrow> cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr240 \<sigma> x ko' t ta tb ep'a tc endpoint p a a' b b') \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 9. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (\<lambda>p. map_option (\<lambda>_. byte_to_word_heap (underlying_memory (ksMachineState \<sigma>)) p) (map_to_user_data (ksPSpace \<sigma>) p)) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (\<lambda>p. map_option (\<lambda>_. byte_to_word_heap (underlying_memory (ksMachineState \<sigma>)) p) (map_to_user_data (ksPSpace \<sigma>) p)) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift ta = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 8. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>_; cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (\<lambda>p. map_option (\<lambda>_. byte_to_word_heap (underlying_memory (ksMachineState \<sigma>_)) p) (map_to_user_data (ksPSpace \<sigma>_) p)) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift ta_ = map_option tcb_null_ep_ptrs \<circ> cslift x_ proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 7. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>_; cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>_) (globals x_\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)))\<rparr>) proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>; cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; isSendEP ep' \<or> isRecvEP ep'; tcb_at' thread \<sigma>_; cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); epQueue ep' = [thread]; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>_) (globals x_\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)))\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; (\<sigma>_, x_) \<in> rf_sr; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> updateObject val_ old_ ptr_ ptr'_ next_ = updateObject_default val_ old_ ptr_ ptr'_ next_ proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; (\<sigma>_, x_) \<in> rf_sr; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v_ proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; (\<sigma>_, x_) \<in> rf_sr; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = NULL; (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) = NULL; endpoint_lift endpoint_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc_) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint_) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> objBits v_ = objBits v'_ proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc endpoint. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = NULL; (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL; endpoint_lift endpoint = endpoint_lift ko'\<lparr>epQueue_head_CL := 0, epQueue_tail_CL := 0, endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Idle && mask 2\<rparr>; t_hrs_' (globals tc) = hrs_mem_update (heap_update (ep_Ptr ep) endpoint) (hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))); remove1 thread (epQueue ep') = []\<rbrakk> \<Longrightarrow> obj_at' (?P179 \<sigma> x ko' t ta tb ep'a tc endpoint) ep \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setEndpoint ep (if remove1 thread (epQueue ep') = [] then Structures_H.endpoint.IdleEP else epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<forall>tc\<in>set (remove1 thread (epQueue ep')). tcb_at' tc (?s256 \<sigma> x ko' t ta tb ep'a)
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL) = (remove1 thread (epQueue ep') = [])\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; tc \<in> set (remove1 thread (epQueue ep'))\<rbrakk> \<Longrightarrow> tc \<in> set (epQueue ep')
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL) = (remove1 thread (epQueue ep') = [])\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a tc. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> set (remove1 thread (epQueue ep')) \<subseteq> set (epQueue ep')
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL) = (remove1 thread (epQueue ep') = [])\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; ((if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) = NULL) = (remove1 thread (epQueue ep') = [])\<rbrakk> \<Longrightarrow> (remove1 thread (epQueue ep') = [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep Structures_H.endpoint.IdleEP \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) \<and> (remove1 thread (epQueue ep') \<noteq> [] \<longrightarrow> (\<exists>xa\<in>fst (setEndpoint ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ep (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') \<sigma>). (snd xa, x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep \<mapsto> injectKOS (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep'))\<rparr>), x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ep \<mapsto> injectKOS (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep'))\<rparr>), x\<lparr>queue_' := ret__struct_tcb_queue_C_' ta, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep')))) ((cslift x)(ep_Ptr ep \<mapsto> ep'a)) ep_Ptr (cendpoint_relation (cslift ta)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta)) \<and> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep')))) ((cslift x)(ep_Ptr ep \<mapsto> ep'a)) ep_Ptr (cendpoint_relation (cslift ta)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta)) \<and> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift ta) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep')))) ((cslift x)(ep_Ptr ep \<mapsto> ep'a)) ep_Ptr (cendpoint_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift ta = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep')))) ((cslift x)(ep_Ptr ep \<mapsto> ep'a)) ep_Ptr (cendpoint_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL; x_ \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift ta_ = map_option tcb_null_queue_ptrs \<circ> cslift x_ proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(ep \<mapsto> KOEndpoint (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep')))) ((cslift x)(ep_Ptr ep \<mapsto> ep'a)) ep_Ptr (cendpoint_relation (cslift ta))
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift ta) (epQueue_update (\<lambda>_. remove1 thread (epQueue ep')) ep') ep'a
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a x1. \<lbrakk>x1 \<noteq> []; \<forall>t\<in>set x1. tcb_at' t \<sigma>; distinct x1; cslift x (ep_Ptr ep) = Some ko'; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> ep_queue_relation' (cslift x) x1 (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))); head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread x1) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x1)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x1)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x1 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; thread \<in> set x1; ep' = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x1) (tcb_Ptr (ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4)) (tcb_Ptr (ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4))
 2. \<And>\<sigma> x ko' t ta tb ep'a x3. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ep_Ptr ep) = Some ko'; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) x3 (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))); head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread x3) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' (Structures_H.endpoint.SendEP x3) ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' (Structures_H.endpoint.SendEP x3) \<sigma>; thread \<in> set x3; ep' = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x3) (tcb_Ptr (ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4)) (tcb_Ptr (ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4))
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 8. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 9. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 10. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a x1 v va vb. \<lbrakk>x1 \<noteq> []; \<forall>t\<in>set x1. tcb_at' t \<sigma>; distinct x1; cslift x (ep_Ptr ep) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C v = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread x1) (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C v = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x1)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x1)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C v = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x1 \<noteq> [thread]; (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' (Structures_H.endpoint.RecvEP x1) \<sigma>; thread \<in> set x1; ep' = Structures_H.endpoint.RecvEP x1; cslift x (tcb_ptr_to_ctcb_ptr thread) = Some v; cslift x intStateIRQNode_array_Ptr = Some va; cslift x armKSGlobalPD_Ptr = Some vb; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; ep_queue_relation' (cslift x) x1 (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')))\<rbrakk> \<Longrightarrow> (tcbEPPrev_C v = NULL \<longrightarrow> (tcbEPNext_C v = NULL \<longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x1) NULL NULL) \<and> (tcbEPNext_C v \<noteq> NULL \<longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x1) (tcbEPNext_C v) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))))) \<and> (tcbEPPrev_C v \<noteq> NULL \<longrightarrow> (tcbEPNext_C v = NULL \<longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x1) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcbEPPrev_C v)) \<and> (tcbEPNext_C v \<noteq> NULL \<longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x1) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')))))
 2. \<And>\<sigma> x ko' t ta tb ep'a x3. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ep_Ptr ep) = Some ko'; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) x3 (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))); head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread x3) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' (Structures_H.endpoint.SendEP x3) ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' (Structures_H.endpoint.SendEP x3) \<sigma>; thread \<in> set x3; ep' = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x3) (tcb_Ptr (ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4)) (tcb_Ptr (ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4))
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 8. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 9. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 10. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x1_ \<noteq> []; \<forall>t\<in>set x1_. tcb_at' t \<sigma>_; distinct x1_; cslift x_ (ep_Ptr ep) = Some ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C v_ = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C v_ = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread x1_) (if tcbEPPrev_C v_ = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C v_ = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x1_)\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x1_)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C v_ = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C v_ = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); x1_ \<noteq> [thread]; (if tcbEPPrev_C v_ = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' (Structures_H.endpoint.RecvEP x1_) ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' (Structures_H.endpoint.RecvEP x1_) \<sigma>_; thread \<in> set x1_; ep' = Structures_H.endpoint.RecvEP x1_; cslift x_ (tcb_ptr_to_ctcb_ptr thread) = Some v_; cslift x_ intStateIRQNode_array_Ptr = Some va_; cslift x_ armKSGlobalPD_Ptr = Some vb_; endpoint_CL.state_CL (endpoint_lift ko'_) = SCAST(32 signed \<rightarrow> 32) EPState_Recv; ep_queue_relation' (cslift x_) x1_ (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)))\<rbrakk> \<Longrightarrow> (tcbEPPrev_C v_ = NULL \<longrightarrow> (tcbEPNext_C v_ = NULL \<longrightarrow> ep_queue_relation' (cslift ta_) (remove1 thread x1_) NULL NULL) \<and> (tcbEPNext_C v_ \<noteq> NULL \<longrightarrow> ep_queue_relation' (cslift ta_) (remove1 thread x1_) (tcbEPNext_C v_) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_))))) \<and> (tcbEPPrev_C v_ \<noteq> NULL \<longrightarrow> (tcbEPNext_C v_ = NULL \<longrightarrow> ep_queue_relation' (cslift ta_) (remove1 thread x1_) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_))) (tcbEPPrev_C v_)) \<and> (tcbEPNext_C v_ \<noteq> NULL \<longrightarrow> ep_queue_relation' (cslift ta_) (remove1 thread x1_) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_))))) proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a x3. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ep_Ptr ep) = Some ko'; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send \<and> ep_queue_relation' (cslift x) x3 (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))); head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread x3) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' (Structures_H.endpoint.SendEP x3) ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' (Structures_H.endpoint.SendEP x3) \<sigma>; thread \<in> set x3; ep' = Structures_H.endpoint.SendEP x3\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x3) (tcb_Ptr (ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4)) (tcb_Ptr (ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4))
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a x3 v va vb. \<lbrakk>x3 \<noteq> []; \<forall>t\<in>set x3. tcb_at' t \<sigma>; distinct x3; cslift x (ep_Ptr ep) = Some ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C v = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread x3) (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C v = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C v = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); x3 \<noteq> [thread]; (if tcbEPPrev_C v = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' (Structures_H.endpoint.SendEP x3) ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' (Structures_H.endpoint.SendEP x3) \<sigma>; thread \<in> set x3; ep' = Structures_H.endpoint.SendEP x3; cslift x (tcb_ptr_to_ctcb_ptr thread) = Some v; cslift x intStateIRQNode_array_Ptr = Some va; cslift x armKSGlobalPD_Ptr = Some vb; endpoint_CL.state_CL (endpoint_lift ko') = SCAST(32 signed \<rightarrow> 32) EPState_Send; ep_queue_relation' (cslift x) x3 (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')))\<rbrakk> \<Longrightarrow> (tcbEPPrev_C v = NULL \<longrightarrow> (tcbEPNext_C v = NULL \<longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x3) NULL NULL) \<and> (tcbEPNext_C v \<noteq> NULL \<longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x3) (tcbEPNext_C v) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'))))) \<and> (tcbEPPrev_C v \<noteq> NULL \<longrightarrow> (tcbEPNext_C v = NULL \<longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x3) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcbEPPrev_C v)) \<and> (tcbEPNext_C v \<noteq> NULL \<longrightarrow> ep_queue_relation' (cslift ta) (remove1 thread x3) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')))))
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>x3_ \<noteq> []; \<forall>t\<in>set x3_. tcb_at' t \<sigma>_; distinct x3_; cslift x_ (ep_Ptr ep) = Some ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C v_ = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C v_ = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread x3_) (if tcbEPPrev_C v_ = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C v_ = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3_)\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set x3_)\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C v_ = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C v_ = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); x3_ \<noteq> [thread]; (if tcbEPPrev_C v_ = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' (Structures_H.endpoint.SendEP x3_) ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' (Structures_H.endpoint.SendEP x3_) \<sigma>_; thread \<in> set x3_; ep' = Structures_H.endpoint.SendEP x3_; cslift x_ (tcb_ptr_to_ctcb_ptr thread) = Some v_; cslift x_ intStateIRQNode_array_Ptr = Some va_; cslift x_ armKSGlobalPD_Ptr = Some vb_; endpoint_CL.state_CL (endpoint_lift ko'_) = SCAST(32 signed \<rightarrow> 32) EPState_Send; ep_queue_relation' (cslift x_) x3_ (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)))\<rbrakk> \<Longrightarrow> (tcbEPPrev_C v_ = NULL \<longrightarrow> (tcbEPNext_C v_ = NULL \<longrightarrow> ep_queue_relation' (cslift ta_) (remove1 thread x3_) NULL NULL) \<and> (tcbEPNext_C v_ \<noteq> NULL \<longrightarrow> ep_queue_relation' (cslift ta_) (remove1 thread x3_) (tcbEPNext_C v_) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_))))) \<and> (tcbEPPrev_C v_ \<noteq> NULL \<longrightarrow> (tcbEPNext_C v_ = NULL \<longrightarrow> ep_queue_relation' (cslift ta_) (remove1 thread x3_) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_))) (tcbEPPrev_C v_)) \<and> (tcbEPNext_C v_ \<noteq> NULL \<longrightarrow> ep_queue_relation' (cslift ta_) (remove1 thread x3_) (tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_))) (tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_))))) proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL; x_ \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isSendEP ep' \<or> isRecvEP ep' then set (epQueue ep') else {}))\<^esub> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift ta))
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_ntfns (ksPSpace \<sigma>) p = Some a; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift ta) a' b'
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation (cslift ta) a b
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr378 \<sigma> x ko' t ta tb ep'a p a a' b b') \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a p a a' b b'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr378 \<sigma> x ko' t ta tb ep'a p a a b b) \<sigma>
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift ta) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift ta = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL; x_ \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift ta_ = map_option tcb_null_ep_ptrs \<circ> cslift x_ proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL; x_ \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>_) (globals x_\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))\<rparr>) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); epQueue ep' \<noteq> [thread]; (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL; x_ \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>_) (globals x_\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_))\<rparr>) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a val old ptr ptr' next. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; (\<sigma>_, x_) \<in> rf_sr; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> updateObject val_ old_ ptr_ ptr'_ next_ = updateObject_default val_ old_ ptr_ ptr'_ next_ proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a v. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; (\<sigma>_, x_) \<in> rf_sr; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v_ proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb ep'a v v'. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invs' \<sigma>_; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>_; ko_at' ep' ep \<sigma>_; epptr_' x_ = ep_Ptr ep; (\<sigma>_, x_) \<in> rf_sr; valid_ep' ep' \<sigma>_; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>_; distinct (epQueue ep'); cslift x_ (ep_Ptr ep) = Some ko'_; cendpoint_relation (cslift x_) ep' ko'_; head_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko'_)); head_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta_) = (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); ep_queue_relation' (cslift ta_) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))); cslift ta_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; cslift ta_ = cslift x_; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta_)) = zero_ranges_are_zero rs (t_hrs_' (globals x_)); hrs_htd (t_hrs_' (globals ta_)) = hrs_htd (t_hrs_' (globals x_)); endpoint_lift ep'a_ = endpoint_lift ko'_\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a_) (t_hrs_' (globals ta_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x_ (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x_ (epptr_' x_)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> objBits v_ = objBits v'_ proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb ep'a. \<lbrakk>invs' \<sigma>; st_tcb_at' (\<lambda>st. (isBlockedOnSend st \<or> isBlockedOnReceive st) \<and> blockingObject st = ep) thread \<sigma>; ko_at' ep' ep \<sigma>; epptr_' x = ep_Ptr ep; (\<sigma>, x) \<in> rf_sr; valid_ep' ep' \<sigma>; thread \<in> set (epQueue ep'); isSendEP ep' \<or> isRecvEP ep'; epQueue ep' \<noteq> []; \<forall>t\<in>set (epQueue ep'). tcb_at' t \<sigma>; distinct (epQueue ep'); cslift x (ep_Ptr ep) = Some ko'; cendpoint_relation (cslift x) ep' ko'; head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_head_CL (endpoint_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (epQueue_tail_CL (endpoint_lift ko')); head_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' ta) = (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); ep_queue_relation' (cslift ta) (remove1 thread (epQueue ep')) (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))); cslift ta|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue ep'))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; cslift ta = cslift x; \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals ta)) = zero_ranges_are_zero rs (t_hrs_' (globals x)); hrs_htd (t_hrs_' (globals ta)) = hrs_htd (t_hrs_' (globals x)); endpoint_lift ep'a = endpoint_lift ko'\<lparr>epQueue_head_CL := ptr_val (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4, epQueue_tail_CL := ptr_val (if tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (epptr_' x)))))) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr ep) ep'a) (t_hrs_' (globals ta)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift ta x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); remove1 thread (epQueue ep') \<noteq> []; (if tcbEPPrev_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) = NULL then tcbEPNext_C (the (cslift x (tcb_ptr_to_ctcb_ptr thread))) else tcb_Ptr (epQueue_head_CL (endpoint_lift (the (cslift x (epptr_' x)))))) \<noteq> NULL\<rbrakk> \<Longrightarrow> obj_at' (?P266 \<sigma> x ko' t ta tb ep'a) ep \<sigma> proof (prove)
goal:
No subgoals!