theory Fastpath_C

lemma fastpath_enqueue_ccorres:
  "\<lbrakk> epptr' = ep_Ptr epptr \<rbrakk> \<Longrightarrow>
   ccorres dc xfdc
         (ko_at' ep epptr and (\<lambda>s. thread = ksCurThread s)
                and (\<lambda>s. sym_refs ((state_refs_of' s) (thread := {r \<in> state_refs_of' s thread. snd r = TCBBound})))
                and K (\<not> isSendEP ep) and valid_pspace' and cur_tcb')
         UNIV hs
     (setEndpoint epptr (case ep of IdleEP \<Rightarrow> RecvEP [thread] | RecvEP ts \<Rightarrow> RecvEP (ts @ [thread])))
     (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail(epptr');;
      \<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
      IF \<acute>endpointTail = tcb_Ptr 0 THEN
         (Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t \<acute>ksCurThread\<rbrace>
            (ptr_basic_update (\<lambda>s. tcb_Ptr_Ptr &((ksCurThread_' (globals s))\<rightarrow>[''tcbEPPrev_C''])) (\<lambda>_. NULL)));;
         (Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t \<acute>ksCurThread\<rbrace>
          (ptr_basic_update (\<lambda>s. tcb_Ptr_Ptr &((ksCurThread_' (globals s))\<rightarrow>[''tcbEPNext_C''])) (\<lambda>_. NULL)));;
           (CALL endpoint_ptr_set_epQueue_head_np(epptr',ucast (ptr_val \<acute>ksCurThread)));;
           (CALL endpoint_ptr_mset_epQueue_tail_state(epptr',ucast (ptr_val \<acute>ksCurThread),
            scast EPState_Recv))
      ELSE
        Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t \<acute>endpointTail\<rbrace>
          (ptr_basic_update (\<lambda>s. tcb_Ptr_Ptr &((endpointTail_' s)\<rightarrow>[''tcbEPNext_C'']))
                      (ksCurThread_' o globals));;
         (Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t \<acute>ksCurThread\<rbrace>
          (ptr_basic_update (\<lambda>s. tcb_Ptr_Ptr &((ksCurThread_' (globals s))\<rightarrow>[''tcbEPPrev_C'']))
                      endpointTail_'));;
         (Guard C_Guard \<lbrace>hrs_htd \<acute>t_hrs \<Turnstile>\<^sub>t \<acute>ksCurThread\<rbrace>
          (ptr_basic_update (\<lambda>s. tcb_Ptr_Ptr &((ksCurThread_' (globals s))\<rightarrow>[''tcbEPNext_C'']))
                      (\<lambda>_. NULL)));;
           (CALL endpoint_ptr_mset_epQueue_tail_state(epptr',ucast (ptr_val \<acute>ksCurThread),
            scast EPState_Recv))
      FI)" unfolding setEndpoint_def apply clarsimp apply (rule setObject_ccorres_helper[rotated]) apply simp apply (simp add: objBits_simps') apply (rule conseqPre, vcg) apply clarsimp apply (drule(1) ko_at_obj_congD') apply (frule ko_at_valid_ep', clarsimp) apply (rule cmap_relationE1[OF cmap_relation_ep], assumption,
         erule ko_at_projectKO_opt) apply (simp add: cur_tcb'_def) apply (drule(1) obj_at_cslift_tcb) apply (clarsimp simp: typ_heap_simps' valid_ep'_def rf_sr_ksCurThread) apply (cases ep,
         simp_all add: isSendEP_def cendpoint_relation_def Let_def
                       tcb_queue_relation'_def) apply (rename_tac list) apply (clarsimp simp: NULL_ptr_val[symmetric] tcb_queue_relation_last_not_NULL
                         ct_in_state'_def
                  dest!: trans [OF sym [OF ptr_val_def] arg_cong[where f=ptr_val]]) apply (frule obj_at_cslift_tcb[rotated], erule(1) bspec[OF _ last_in_set]) apply clarsimp apply (drule(2) sym_refs_upd_tcb_sD) apply clarsimp apply (frule st_tcb_at_not_in_ep_queue,
          fastforce, simp+) apply (subgoal_tac "ksCurThread \<sigma> \<noteq> last list") prefer 2 apply clarsimp apply (clarsimp simp: typ_heap_simps' EPState_Recv_def mask_def
                         is_aligned_weaken[OF is_aligned_tcb_ptr_to_ctcb_ptr]) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def update_ep_map_tos
                          typ_heap_simps') apply (rule conjI, erule ctcb_relation_null_queue_ptrs) apply (rule ext, simp add: tcb_null_queue_ptrs_def
                         split: if_split) apply (rule conjI) apply (rule_tac S="tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list)"
                   in cpspace_relation_ep_update_an_ep,
                 assumption+) apply (simp add: cendpoint_relation_def Let_def EPState_Recv_def
                          tcb_queue_relation'_def) apply (drule_tac qend="tcb_ptr_to_ctcb_ptr (last list)"
                     and qend'="tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)"
                     and tn_update="tcbEPNext_C_update"
                     and tp_update="tcbEPPrev_C_update"
                     in tcb_queue_relation_append,
                    clarsimp+, simp_all)[1] apply (rule sym, erule init_append_last) apply (fastforce simp: tcb_at_not_NULL) apply (clarsimp simp add: tcb_at_not_NULL[OF obj_at'_weakenE[OF _ TrueI]]) apply clarsimp+ apply (subst st_tcb_at_not_in_ep_queue, assumption, blast, clarsimp+) apply (drule(1) ep_ep_disjoint[rotated -1, where epptr=epptr],
            blast, blast,
            simp_all add: Int_commute endpoint_not_idle_cases image_image)[1] apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cntfn_relation_double_fun_upd) apply (rule cnotification_relation_ep_queue, assumption+) apply fastforce apply (simp add: isRecvEP_def) apply simp apply (fastforce dest!: map_to_ko_atI) apply (rule cnotification_relation_q_cong) apply (clarsimp split: if_split) apply (clarsimp simp: restrict_map_def ntfn_q_refs_of'_def
                   split: if_split Structures_H.notification.split_asm Structures_H.ntfn.split_asm) apply (erule notE[rotated], erule_tac ntfnptr=p and ntfn=a in st_tcb_at_not_in_ntfn_queue,
           auto dest!: map_to_ko_atI)[1] apply (simp add: carch_state_relation_def typ_heap_simps' update_ep_map_tos
                    cmachine_state_relation_def h_t_valid_clift_Some_iff) apply (erule cready_queues_relation_null_queue_ptrs) apply (rule ext, simp add: tcb_null_ep_ptrs_def split: if_split) apply (clarsimp simp: typ_heap_simps' EPState_Recv_def mask_def
                        is_aligned_weaken[OF is_aligned_tcb_ptr_to_ctcb_ptr]) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def) apply (drule(2) sym_refs_upd_tcb_sD) apply (rule conjI) apply (clarsimp simp: cpspace_relation_def update_ep_map_tos
                         typ_heap_simps' ct_in_state'_def) apply (rule conjI, erule ctcb_relation_null_queue_ptrs) apply (rule ext, simp add: tcb_null_queue_ptrs_def
                        split: if_split) apply (rule conjI) apply (rule_tac S="{tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)}"
                 in cpspace_relation_ep_update_an_ep, assumption+) apply (simp add: cendpoint_relation_def Let_def EPState_Recv_def
                         tcb_queue_relation'_def) apply clarsimp+ apply (erule notE[rotated], erule st_tcb_at_not_in_ep_queue,
           auto)[1] apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cnotification_relation_q_cong) apply (clarsimp split: if_split) apply (clarsimp simp: restrict_map_def ntfn_q_refs_of'_def
                  split: if_split Structures_H.notification.split_asm Structures_H.ntfn.split_asm) apply (erule notE[rotated], rule_tac ntfnptr=p and ntfn=a in st_tcb_at_not_in_ntfn_queue,
          assumption+, auto dest!: map_to_ko_atI)[1] apply (simp add: carch_state_relation_def typ_heap_simps' update_ep_map_tos
                   cmachine_state_relation_def h_t_valid_clift_Some_iff) apply (erule cready_queues_relation_null_queue_ptrs) apply (rule ext, simp add: tcb_null_ep_ptrs_def split: if_split) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. epptr' = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (ko_at' ep epptr and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. sym_refs ((state_refs_of' s)(thread := {r \<in> state_refs_of' s thread. snd r = TCBBound}))) and K (\<not> isSendEP ep) and valid_pspace' and cur_tcb') UNIV hs (setEndpoint epptr (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread])) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(epptr');;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(epptr',UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ksCurThread));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(epptr',UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ksCurThread),SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>(ksCurThread_' \<circ> globals))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(epptr',UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ksCurThread),SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI) proof (prove)
goal (1 subgoal):
 1. epptr' = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (ko_at' ep epptr and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. sym_refs ((state_refs_of' s)(thread := {r \<in> state_refs_of' s thread. snd r = TCBBound}))) and K (\<not> isSendEP ep) and valid_pspace' and cur_tcb') UNIV hs (setObject epptr (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread])) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(epptr');;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(epptr',UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ksCurThread));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(epptr',UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ksCurThread),SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>(ksCurThread_' \<circ> globals))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(epptr',UCAST(32 \<rightarrow> 32) (ptr_val \<acute>ksCurThread),SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI) proof (prove)
goal (1 subgoal):
 1. epptr' = ep_Ptr epptr \<Longrightarrow> ccorres dc xfdc (ko_at' ep epptr and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. sym_refs ((state_refs_of' s)(thread := {r \<in> state_refs_of' s thread. snd r = TCBBound}))) and (\<lambda>y. \<not> isSendEP ep) and valid_pspace' and cur_tcb') UNIV hs (setObject epptr (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread])) (\<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr epptr);;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI) proof (prove)
goal (3 subgoals):
 1. \<And>ko. epptr' = ep_Ptr epptr \<Longrightarrow> updateObject ko = updateObject_default ko
 2. \<And>ko. epptr' = ep_Ptr epptr \<Longrightarrow> 1 < 2 ^ objBits ko
 3. \<And>\<sigma> ko'. epptr' = ep_Ptr epptr \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' ep epptr and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. sym_refs ((state_refs_of' s)(thread := {r \<in> state_refs_of' s thread. snd r = TCBBound}))) and (\<lambda>y. \<not> isSendEP ep) and valid_pspace' and cur_tcb') \<sigma> \<and> s \<in> UNIV \<and> ko_at' ko' epptr \<sigma>} \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr epptr);;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI {s. (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]))\<rparr>, s) \<in> rf_sr} proof (prove)
goal (2 subgoals):
 1. \<And>ko. epptr' = ep_Ptr epptr \<Longrightarrow> 1 < 2 ^ objBits ko
 2. \<And>\<sigma> ko'. epptr' = ep_Ptr epptr \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' ep epptr and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. sym_refs ((state_refs_of' s)(thread := {r \<in> state_refs_of' s thread. snd r = TCBBound}))) and (\<lambda>y. \<not> isSendEP ep) and valid_pspace' and cur_tcb') \<sigma> \<and> s \<in> UNIV \<and> ko_at' ko' epptr \<sigma>} \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr epptr);;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI {s. (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]))\<rparr>, s) \<in> rf_sr} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko'. epptr' = ep_Ptr epptr \<Longrightarrow> \<Gamma>\<turnstile> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' ep epptr and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. sym_refs ((state_refs_of' s)(thread := {r \<in> state_refs_of' s thread. snd r = TCBBound}))) and (\<lambda>y. \<not> isSendEP ep) and valid_pspace' and cur_tcb') \<sigma> \<and> s \<in> UNIV \<and> ko_at' ko' epptr \<sigma>} \<acute>ret__unsigned :== CALL endpoint_ptr_get_epQueue_tail_'proc(ep_Ptr epptr);;
\<acute>endpointTail :== tcb_Ptr \<acute>ret__unsigned;;
IF \<acute>endpointTail = NULL THEN
  Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) NULL)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_set_epQueue_head_np_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread);;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
ELSE
  Guard C_Guard {s. s \<Turnstile>\<^sub>c endpointTail_' s} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>endpointTail\<rightarrow>[''tcbEPNext_C''])) \<acute>ksCurThread)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPPrev_C''])) \<acute>endpointTail)));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c ksCurThread_' (globals s)} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(\<acute>ksCurThread\<rightarrow>[''tcbEPNext_C''])) NULL)));;
CALL endpoint_ptr_mset_epQueue_tail_state_'proc(ep_Ptr epptr,ptr_val \<acute>ksCurThread,SCAST(32 signed \<rightarrow> 32) EPState_Recv)
FI {s. (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]))\<rparr>, s) \<in> rf_sr} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko'. epptr' = ep_Ptr epptr \<Longrightarrow> {s. (\<sigma>, s) \<in> rf_sr \<and> (ko_at' ep epptr and (\<lambda>s. thread = ksCurThread s) and (\<lambda>s. sym_refs ((state_refs_of' s)(thread := {r \<in> state_refs_of' s thread. snd r = TCBBound}))) and (\<lambda>y. \<not> isSendEP ep) and valid_pspace' and cur_tcb') \<sigma> \<and> s \<in> UNIV \<and> ko_at' ko' epptr \<sigma>} \<subseteq> {s. s \<Turnstile>\<^sub>c ep_Ptr epptr \<and> (\<forall>t. ret__unsigned_' t = epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))) \<longrightarrow> (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))) = NULL \<longrightarrow> s \<Turnstile>\<^sub>c ksCurThread_' (globals s) \<and> hrs_htd (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t ksCurThread_' (globals s) \<and> hrs_htd (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals s)))) \<Turnstile>\<^sub>t ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals s))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals s)))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (ksCurThread_' (globals s))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals s))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals s))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals s))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]))\<rparr>, s\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))), endpointTail_' := NULL, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))) \<noteq> NULL \<longrightarrow> s \<Turnstile>\<^sub>c tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))) \<and> hrs_htd (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals s))) (t_hrs_' (globals s))) \<Turnstile>\<^sub>t ksCurThread_' (globals s) \<and> hrs_htd (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals s))) (t_hrs_' (globals s)))) \<Turnstile>\<^sub>t ksCurThread_' (globals s) \<and> hrs_htd (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals s))) (t_hrs_' (globals s))))) \<Turnstile>\<^sub>t ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals s))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals s))) (t_hrs_' (globals s))))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals s))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals s)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals s))) (t_hrs_' (globals s)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> injectKOS (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [thread]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [thread]))\<rparr>, s\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr)))), endpointTail_' := tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift s (ep_Ptr epptr))))), globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; ko_at' ep epptr \<sigma>; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); \<not> isSendEP ep; valid_pspace' \<sigma>; cur_tcb' \<sigma>; ko_at' ko' epptr \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. ret__unsigned_' t = epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<longrightarrow> (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 \<longrightarrow> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x))))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))), endpointTail_' := tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); \<not> isSendEP ep; valid_pspace' \<sigma>; cur_tcb' \<sigma>; ko_at' ko' epptr \<sigma>; ep = ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. ret__unsigned_' t = epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<longrightarrow> (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 \<longrightarrow> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x))))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))), endpointTail_' := tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); \<not> isSendEP ep; valid_pspace' \<sigma>; cur_tcb' \<sigma>; ko_at' ko' epptr \<sigma>; ep = ko'; valid_ep' ko' \<sigma>\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. ret__unsigned_' t = epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<longrightarrow> (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 \<longrightarrow> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x))))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))), endpointTail_' := tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x y'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); \<not> isSendEP ep; valid_pspace' \<sigma>; cur_tcb' \<sigma>; ko_at' ko' epptr \<sigma>; ep = ko'; valid_ep' ko' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some ko'; cendpoint_relation (cslift x) ko' y'; cslift x (ep_Ptr epptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. ret__unsigned_' t = epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<longrightarrow> (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) = 0 \<longrightarrow> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))) \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))) \<and> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x))))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr)))), endpointTail_' := tcb_Ptr (epQueue_tail_CL (endpoint_lift (the (cslift x (ep_Ptr epptr))))), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x y'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); \<not> isSendEP ko'; valid_pspace' \<sigma>; tcb_at' (ksCurThread \<sigma>) \<sigma>; ko_at' ko' epptr \<sigma>; ep = ko'; valid_ep' ko' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some ko'; cendpoint_relation (cslift x) ko' y'; cslift x (ep_Ptr epptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. ret__unsigned_' t = epQueue_tail_CL (endpoint_lift y')) \<longrightarrow> (epQueue_tail_CL (endpoint_lift y') = 0 \<longrightarrow> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ko' of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift y') \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) \<and> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift y')))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x))))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift y')))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ko' of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift y'), endpointTail_' := tcb_Ptr (epQueue_tail_CL (endpoint_lift y')), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> ko' x y'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); \<not> isSendEP ko'; valid_pspace' \<sigma>; ko_at' ko' epptr \<sigma>; ep = ko'; valid_ep' ko' \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some ko'; cendpoint_relation (cslift x) ko' y'; cslift x (ep_Ptr epptr) = Some y'; \<exists>ko ko'. ko_at' ko (ksCurThread \<sigma>) \<sigma> \<and> True \<and> cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> ((\<exists>t. ret__unsigned_' t = epQueue_tail_CL (endpoint_lift y')) \<longrightarrow> (epQueue_tail_CL (endpoint_lift y') = 0 \<longrightarrow> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x)))) (ep_Ptr epptr)))\<lparr>epQueue_head_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) NULL) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ko' of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift y') \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) \<and> x \<Turnstile>\<^sub>c ksCurThread_' (globals x) \<and> x \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (ksCurThread_' (globals x))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift y')))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x))))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (ksCurThread_' (globals x))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPNext_C''])) NULL) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(ksCurThread_' (globals x)\<rightarrow>[''tcbEPPrev_C''])) (tcb_Ptr (epQueue_tail_CL (endpoint_lift y')))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))\<rightarrow>[''tcbEPNext_C''])) (ksCurThread_' (globals x))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ko' of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift y'), endpointTail_' := tcb_Ptr (epQueue_tail_CL (endpoint_lift y')), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); \<not> isSendEP ep; valid_pspace' \<sigma>; ko_at' ep epptr \<sigma>; case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t \<sigma>) \<and> distinct ts | Structures_H.endpoint.IdleEP \<Rightarrow> True | Structures_H.endpoint.SendEP ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t \<sigma>) \<and> distinct ts; map_to_eps (ksPSpace \<sigma>) epptr = Some ep; cendpoint_relation (cslift x) ep y'; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = epQueue_tail_CL (endpoint_lift y')\<rbrakk> \<Longrightarrow> (epQueue_tail_CL (endpoint_lift y') = 0 \<longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift y') \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_Ptr (epQueue_tail_CL (endpoint_lift y'))\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (case ep of Structures_H.endpoint.RecvEP ts \<Rightarrow> Structures_H.endpoint.RecvEP (ts @ [ksCurThread \<sigma>]) | Structures_H.endpoint.IdleEP \<Rightarrow> Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift y'), endpointTail_' := tcb_Ptr (epQueue_tail_CL (endpoint_lift y')), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t x1. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP x1) epptr \<sigma>; x1 \<noteq> [] \<and> (\<forall>t\<in>set x1. tcb_at' t \<sigma>) \<and> distinct x1; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP x1); endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (last x1) \<and> ep_queue_relation (cslift x) x1 NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = epQueue_tail_CL (endpoint_lift y'); ep = Structures_H.endpoint.RecvEP x1\<rbrakk> \<Longrightarrow> (epQueue_tail_CL (endpoint_lift y') = 0 \<longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift y') \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last x1) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last x1)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last x1)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last x1)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last x1)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last x1)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last x1)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (x1 @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift y'), endpointTail_' := tcb_ptr_to_ctcb_ptr (last x1), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; list \<noteq> [] \<and> (\<forall>t\<in>set list. tcb_at' t \<sigma>) \<and> distinct list; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> tcb_Ptr (epQueue_tail_CL (endpoint_lift y')) = tcb_ptr_to_ctcb_ptr (last list) \<and> ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = epQueue_tail_CL (endpoint_lift y'); ep = Structures_H.endpoint.RecvEP list\<rbrakk> \<Longrightarrow> (epQueue_tail_CL (endpoint_lift y') = 0 \<longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr))) \<and> (epQueue_tail_CL (endpoint_lift y') \<noteq> 0 \<longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := epQueue_tail_CL (endpoint_lift y'), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); \<exists>ko ko'. ko_at' ko (last list) \<sigma> \<and> True \<and> cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko' \<and> ctcb_relation ko ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list\<rbrakk> \<Longrightarrow> ksCurThread \<sigma> \<noteq> last list
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list\<rbrakk> \<Longrightarrow> ksCurThread \<sigma> \<noteq> last list
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s'. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Recv; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr (last list) \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (clift (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x))) (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)))))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (h_val (hrs_mem (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))))) (hrs_mem_update (heap_update (tcb_Ptr_Ptr &(tcb_ptr_to_ctcb_ptr (last list)\<rightarrow>[''tcbEPNext_C''])) (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) (t_hrs_' (globals x)))))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr)
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))\<rparr>, x\<lparr>ret__unsigned_' := ptr_val (tcb_ptr_to_ctcb_ptr (last list)), endpointTail_' := tcb_ptr_to_ctcb_ptr (last list), globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) ((cslift x)(ep_Ptr epptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)) = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) ((cslift x)(ep_Ptr epptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) ((cslift x)(ep_Ptr epptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) ((cslift x)(ep_Ptr epptr \<mapsto> endpoint)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>])) endpoint
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub>
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_distinct' \<sigma>
 5. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list) = {}
 6. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 7. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 8. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ep_queue_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (list @ [ksCurThread \<sigma>]) NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y')))
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub>
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_distinct' \<sigma>
 5. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list) = {}
 6. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 7. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 8. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> list = ?queue'269 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint @ [last list]
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set list. tcb_ptr_to_ctcb_ptr x \<noteq> NULL
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<noteq> NULL
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub>
 5. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 6. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_distinct' \<sigma>
 7. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list) = {}
 8. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 9. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 10. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> \<forall>x\<in>set list. tcb_ptr_to_ctcb_ptr x \<noteq> NULL
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<noteq> NULL
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub>
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 5. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_distinct' \<sigma>
 6. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list) = {}
 7. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 8. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 9. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<noteq> NULL
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub>
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_distinct' \<sigma>
 5. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list) = {}
 6. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 7. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 8. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list))\<^esub>
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_distinct' \<sigma>
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` tcb_ptr_to_ctcb_ptr ` set (ksCurThread \<sigma> # list) = {}
 5. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 6. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 7. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> ksCurThread \<sigma> \<notin> set (epQueue ep') \<and> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` tcb_ptr_to_ctcb_ptr ` set list = {}
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` tcb_ptr_to_ctcb_ptr ` set list = {}
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some a; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a' b'
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a b
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) a b
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a b
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' (?ep1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b') (?epptr1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b') s'
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isSendEP (?ep1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b') \<or> isRecvEP (?ep1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b')
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (?ep1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b')))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (?ep1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b')))\<^esub>
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b') s'
 5. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a b
 6. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 7. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isSendEP (Structures_H.endpoint.RecvEP list) \<or> isRecvEP (Structures_H.endpoint.RecvEP list)
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP list)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP list)))\<^esub>
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b') s'
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a b
 5. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 6. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP list)))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (epQueue (Structures_H.endpoint.RecvEP list)))\<^esub>
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b') s'
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a b
 4. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 5. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?ntfnPtr1534 \<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b') s'
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a b
 3. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 4. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a b
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a a' b b' tb rf. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b; (tb, rf) \<in> ntfn_q_refs_of' (ntfnObj a)\<rbrakk> \<Longrightarrow> ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (tcb_ptr_to_ctcb_ptr tb) = ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (tcb_ptr_to_ctcb_ptr tb)
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a b rf. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some a; cslift x (ntfn_Ptr p) = Some b; (ksCurThread \<sigma>, rf) \<in> ntfn_q_refs_of' (ntfnObj a)\<rbrakk> \<Longrightarrow> ko'a = tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint p a b x3. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some a; cslift x (ntfn_Ptr p) = Some b; ntfnObj a = Structures_H.ntfn.WaitingNtfn x3; ksCurThread \<sigma> \<in> set x3\<rbrakk> \<Longrightarrow> ko'a = tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)
 2. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 3. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP (list @ [ksCurThread \<sigma>]))))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; \<exists>v. cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t list koa ko' s' ta endpoint. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' (Structures_H.endpoint.RecvEP list) epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some (Structures_H.endpoint.RecvEP list); cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ep = Structures_H.endpoint.RecvEP list; list \<noteq> []; endpoint_CL.state_CL (endpoint_lift y') = 2; \<forall>t\<in>set list. tcb_at' t \<sigma>; distinct list; ep_queue_relation (cslift x) list NULL (tcb_Ptr (epQueue_head_CL (endpoint_lift y'))); epQueue_tail_CL (endpoint_lift y') = ptr_val (tcb_ptr_to_ctcb_ptr (last list)); ko_at' koa (last list) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (last list)) = Some ko'; ctcb_relation koa ko'; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; ksCurThread \<sigma> \<notin> set list; ksCurThread \<sigma> \<noteq> last list; endpoint_lift endpoint = endpoint_lift y'\<lparr>endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) ko'a)) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko')) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; \<exists>v. cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> (cslift x)(tcb_ptr_to_ctcb_ptr (last list) \<mapsto> tcbEPNext_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) ko', tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. tcb_ptr_to_ctcb_ptr (last list)) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)) = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'a t. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle \<and> epQueue_tail_CL (endpoint_lift y') = 0 \<and> epQueue_head_CL (endpoint_lift y') = 0; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> (\<forall>t. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))) \<longrightarrow> t \<Turnstile>\<^sub>c ep_Ptr epptr \<and> is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))) 4 \<and> SCAST(32 signed \<rightarrow> 32) EPState_Recv && mask 2 = SCAST(32 signed \<rightarrow> 32) EPState_Recv \<and> (\<forall>ta. (\<exists>endpoint. endpoint_lift endpoint = endpoint_lift (the (cslift t (ep_Ptr epptr)))\<lparr>endpoint_CL.state_CL := SCAST(32 signed \<rightarrow> 32) EPState_Recv, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (t_hrs_' (globals t))) \<longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals ta)\<rparr>\<rparr>) \<in> rf_sr)) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; (\<sigma>, x) \<in> rf_sr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rbrakk> \<Longrightarrow> (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))\<rparr>, x\<lparr>ret__unsigned_' := 0, endpointTail_' := NULL, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ksCurThread \<sigma> := {r \<in> state_refs_of' \<sigma> (ksCurThread \<sigma>). snd r = TCBBound})); valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) ((cslift x)(ep_Ptr epptr \<mapsto> endpointa)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> (cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)) = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) ((cslift x)(ep_Ptr epptr \<mapsto> endpointa)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 3. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) ((cslift x)(ep_Ptr epptr \<mapsto> endpointa)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)))) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) ((cslift x)(ep_Ptr epptr \<mapsto> endpointa)) ep_Ptr (cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 3. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cendpoint_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>]) endpointa
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))|\<^bsub>(- {tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)})\<^esub>
 3. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 4. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_distinct' \<sigma>
 5. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s' epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` {tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)} = {}
 6. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 7. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> (cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))|\<^bsub>(- {tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)})\<^esub>
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_aligned' \<sigma>
 3. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> pspace_distinct' \<sigma>
 4. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s' epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP\<rbrakk> \<Longrightarrow> set (epQueue ep') \<inter> ctcb_ptr_to_tcb_ptr ` {tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)} = {}
 5. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 6. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s' epptr'a ep'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; ko_at' ep' epptr'a \<sigma>; epptr'a \<noteq> epptr; ep' \<noteq> Structures_H.endpoint.IdleEP; ksCurThread \<sigma> \<in> set (epQueue ep')\<rbrakk> \<Longrightarrow> False
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 3. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))))
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s' p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some a; map_to_ntfns (ksPSpace \<sigma>) p = Some a'; cslift x (ntfn_Ptr p) = Some b; cslift x (ntfn_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a' b'
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s' p a a' b b'. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) a b = cnotification_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) a b
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s' p a a' b b' tc rf. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; a' = a; map_to_ntfns (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ntfn_Ptr p) = Some b; (tc, rf) \<in> ntfn_q_refs_of' (ntfnObj a)\<rbrakk> \<Longrightarrow> cslift x (tcb_ptr_to_ctcb_ptr tc) = ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (tcb_ptr_to_ctcb_ptr tc)
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s' p a b rf. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some a; cslift x (ntfn_Ptr p) = Some b; (ksCurThread \<sigma>, rf) \<in> ntfn_q_refs_of' (ntfnObj a)\<rbrakk> \<Longrightarrow> ko'a = tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa s' p a b x3. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; sym_refs (state_refs_of' s'); cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); \<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s'; st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'; cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; map_to_ntfns (ksPSpace \<sigma>) p = Some a; cslift x (ntfn_Ptr p) = Some b; ntfnObj a = Structures_H.ntfn.WaitingNtfn x3; ksCurThread \<sigma> \<in> set x3\<rbrakk> \<Longrightarrow> ko'a = tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)
 2. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation (clift (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))))\<rparr>) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(epptr \<mapsto> KOEndpoint (Structures_H.endpoint.RecvEP [ksCurThread \<sigma>])))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; \<exists>v. cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> cready_queues_relation ((cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x y' ko ko'a t ta endpoint tb endpointa. \<lbrakk>epptr' = ep_Ptr epptr; thread = ksCurThread \<sigma>; valid_pspace' \<sigma>; ko_at' Structures_H.endpoint.IdleEP epptr \<sigma>; map_to_eps (ksPSpace \<sigma>) epptr = Some Structures_H.endpoint.IdleEP; cslift x (ep_Ptr epptr) = Some y'; ko_at' ko (ksCurThread \<sigma>) \<sigma>; cslift x (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) = Some ko'a; ctcb_relation ko ko'a; ret__unsigned_' t = 0; ep = Structures_H.endpoint.IdleEP; endpoint_CL.state_CL (endpoint_lift y') = SCAST(32 signed \<rightarrow> 32) EPState_Idle; epQueue_tail_CL (endpoint_lift y') = 0; epQueue_head_CL (endpoint_lift y') = 0; endpoint_lift endpoint = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x)))); endpoint_lift endpointa = endpoint_lift y'\<lparr>epQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)), endpoint_CL.state_CL := 2, epQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>))\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ep_Ptr epptr) endpointa) (hrs_mem_update (heap_update (ep_Ptr epptr) endpoint) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a))) (hrs_mem_update (heap_update (tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>)) (tcbEPPrev_C_update (\<lambda>_. NULL) ko'a)) (t_hrs_' (globals x))))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>) \<and> armKSKernelVSpace (ksArchState \<sigma>) = armKSKernelVSpace_C \<and> array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)) \<and> array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)) \<and> asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> carch_globals (ksArchState \<sigma>); irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)) \<and> irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)) \<and> device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)) \<and> exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)) \<and> machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; \<exists>v. cslift x intStateIRQNode_array_Ptr = Some v; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; \<exists>v. cslift x armKSGlobalPD_Ptr = Some v; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; \<exists>s'. sym_refs (state_refs_of' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> (\<forall>p' ko'. ko_at' ko' p' \<sigma> \<longrightarrow> ko_at' ko' p' s') \<and> st_tcb_at' ((=) Structures_H.thread_state.Running) (ksCurThread \<sigma>) s'\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> (cslift x)(tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<mapsto> tcbEPPrev_C_update (\<lambda>_. NULL) (tcbEPNext_C_update (\<lambda>_. NULL) ko'a)) = map_option tcb_null_ep_ptrs \<circ> cslift x proof (prove)
goal:
No subgoals!