theory Finalise_C

lemma cancelAllSignals_ccorres:
  "ccorres dc xfdc
   (invs') (UNIV \<inter> {s. ntfnPtr_' s = Ptr ntfnptr}) []
   (cancelAllSignals ntfnptr) (Call cancelAllSignals_'proc)" apply (cinit lift: ntfnPtr_') apply (rule ccorres_symb_exec_l [OF _ get_ntfn_inv' _ empty_fail_getNotification]) apply (rule_tac xf'=ret__unsigned_'
                and val="case ntfnObj ntfn of IdleNtfn \<Rightarrow> scast NtfnState_Idle
                            | ActiveNtfn _ \<Rightarrow> scast NtfnState_Active | WaitingNtfn _ \<Rightarrow> scast NtfnState_Waiting"
                and R="ko_at' ntfn ntfnptr"
             in ccorres_symb_exec_r_known_rv_UNIV[where R'=UNIV]) apply vcg apply clarsimp apply (erule cmap_relationE1 [OF cmap_relation_ntfn]) apply (erule ko_at_projectKO_opt) apply (clarsimp simp add: typ_heap_simps) apply (simp add: cnotification_relation_def Let_def
                 split: ntfn.split_asm) apply ceqv apply (rule_tac A="invs' and ko_at' ntfn ntfnptr"
              in ccorres_guard_imp2[where A'=UNIV]) apply wpc apply (simp add: notification_state_defs ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (simp add: notification_state_defs ccorres_cond_iffs) apply (rule ccorres_return_Skip) apply (rename_tac list) apply (simp add: notification_state_defs ccorres_cond_iffs Collect_True
                  del: Collect_const) apply (rule ccorres_rhs_assoc)+ apply csymbr apply (rule ccorres_abstract_cleanup) apply csymbr apply (rule ccorres_rhs_assoc2, rule ccorres_rhs_assoc2) apply (rule_tac r'=dc and xf'=xfdc in ccorres_split_nothrow) apply (rule_tac P="ko_at' ntfn ntfnptr and invs'"
                   in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply clarsimp apply (rule_tac x=ntfnptr in cmap_relationE1 [OF cmap_relation_ntfn], assumption) apply (erule ko_at_projectKO_opt) apply (clarsimp simp: typ_heap_simps setNotification_def) apply (rule rev_bexI) apply (rule setObject_eq, simp_all add: objBits_simps')[1] apply (clarsimp simp: rf_sr_def cstate_relation_def
                                Let_def carch_state_relation_def carch_globals_def
                                cmachine_state_relation_def) apply (clarsimp simp: cpspace_relation_def typ_heap_simps'
                                update_ntfn_map_tos) apply (erule(2) cpspace_relation_ntfn_update_ntfn) subgoal by (simp add: cnotification_relation_def notification_state_defs Let_def) subgoal by simp apply (rule ceqv_refl) apply (simp only: ccorres_seq_skip) apply (rule ccorres_split_nothrow_novcg) apply (rule cancel_all_ccorres_helper) apply ceqv apply (ctac add: rescheduleRequired_ccorres) apply (wp cancelAllIPC_mapM_x_valid_queues) apply (wp mapM_x_wp' weak_sch_act_wf_lift_linear
                   sts_st_tcb' | clarsimp simp: valid_tcb_state'_def split: if_split)+ apply (simp add: guard_is_UNIV_def) apply (wp set_ntfn_valid_objs' hoare_vcg_const_Ball_lift
                 weak_sch_act_wf_lift_linear) apply vcg apply clarsimp apply (rule cmap_relationE1[OF cmap_relation_ntfn], assumption) apply (erule ko_at_projectKO_opt) apply (frule obj_at_valid_objs', clarsimp+) apply (clarsimp simp add: valid_obj'_def valid_ntfn'_def projectKOs) subgoal by (auto simp: typ_heap_simps cnotification_relation_def
                       Let_def tcb_queue_relation'_def
                       invs_valid_objs' valid_objs'_maxDomain valid_objs'_maxPriority
               intro!: obj_at_conj') apply (clarsimp simp: guard_is_UNIV_def) apply (wp getNotification_wp) apply clarsimp done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc invs' (UNIV \<inter> \<lbrace>\<acute>ntfnPtr = ntfn_Ptr ntfnptr\<rbrace>) [] (cancelAllSignals ntfnptr) (Call cancelAllSignals_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?Q515 ntfnPtr) (?Q'515 ntfnPtr) [SKIP] (do ntfn <- getNotification ntfnptr;
case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> ?Q'515 ntfnPtr proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?Q521 ntfnPtr ntfn) (?Q'521 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (\<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnPtr);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>?Q521 ntfnPtr\<rbrace>
 3. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> ?Q521 ntfnPtr rv s \<longrightarrow> s' \<in> ?Q'521 ntfnPtr rv} proof (prove)
goal (6 subgoals):
 1. \<And>ntfnPtr ntfn s. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<Gamma>\<turnstile> (UNIV \<inter> {s'. ko_at' ntfn ntfnptr s \<and> (s, s') \<in> rf_sr}) \<acute>ret__unsigned :== CALL notification_ptr_get_state_'proc(ntfnPtr) ({s'. (s, s') \<in> rf_sr} \<inter> \<lbrace>\<acute>ret__unsigned = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)\<rbrace>)
 2. \<And>ntfnPtr ntfn rv' t t'. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'528 ntfnPtr ntfn rv')
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?P528 ntfnPtr ntfn) (?Q528 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'528 ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q528 ntfnPtr ntfn)
 5. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. ?P528 ntfnPtr ntfn and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P528 ntfnPtr rv and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ntfn s. UNIV \<inter> {s'. ko_at' ntfn ntfnptr s \<and> (s, s') \<in> rf_sr} \<subseteq> {sa. sa \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ret__unsigned. ret__unsigned = notification_CL.state_CL (notification_lift (the (cslift sa (ntfn_Ptr ntfnptr)))) \<longrightarrow> (s, sa\<lparr>ret__unsigned_' := notification_CL.state_CL (notification_lift (the (cslift sa (ntfn_Ptr ntfnptr))))\<rparr>) \<in> rf_sr \<and> notification_CL.state_CL (notification_lift (the (cslift sa (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))}
 2. \<And>ntfnPtr ntfn rv' t t'. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'528 ntfnPtr ntfn rv')
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?P528 ntfnPtr ntfn) (?Q528 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'528 ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q528 ntfnPtr ntfn)
 5. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. ?P528 ntfnPtr ntfn and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P528 ntfnPtr rv and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ntfn s x. \<lbrakk>ko_at' ntfn ntfnptr s; (s, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>ntfnPtr ntfn rv' t t'. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'528 ntfnPtr ntfn rv')
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?P528 ntfnPtr ntfn) (?Q528 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'528 ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q528 ntfnPtr ntfn)
 5. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. ?P528 ntfnPtr ntfn and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P528 ntfnPtr rv and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>ntfn s x. ko_at' ntfn ntfnptr s \<Longrightarrow> map_to_ntfns (ksPSpace s) (?x552 ntfn s x) = Some (?y552 ntfn s x)
 2. \<And>ntfn s x y'. \<lbrakk>ko_at' ntfn ntfnptr s; map_to_ntfns (ksPSpace s) (?x552 ntfn s x) = Some (?y552 ntfn s x); cnotification_relation (cslift x) (?y552 ntfn s x) y'; cslift x (ntfn_Ptr (?x552 ntfn s x)) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 3. \<And>ntfnPtr ntfn rv' t t'. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'528 ntfnPtr ntfn rv')
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?P528 ntfnPtr ntfn) (?Q528 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'528 ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 5. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q528 ntfnPtr ntfn)
 6. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. ?P528 ntfnPtr ntfn and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P528 ntfnPtr rv and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ntfn s x y'. \<lbrakk>ko_at' ntfn ntfnptr s; map_to_ntfns (ksPSpace s) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> notification_CL.state_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>ntfnPtr ntfn rv' t t'. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'528 ntfnPtr ntfn rv')
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?P528 ntfnPtr ntfn) (?Q528 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'528 ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q528 ntfnPtr ntfn)
 5. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. ?P528 ntfnPtr ntfn and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P528 ntfnPtr rv and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ntfn s x y'. \<lbrakk>ko_at' ntfn ntfnptr s; map_to_ntfns (ksPSpace s) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'\<rbrakk> \<Longrightarrow> notification_CL.state_CL (notification_lift y') = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)
 2. \<And>ntfnPtr ntfn rv' t t'. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'528 ntfnPtr ntfn rv')
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?P528 ntfnPtr ntfn) (?Q528 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'528 ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q528 ntfnPtr ntfn)
 5. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. ?P528 ntfnPtr ntfn and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P528 ntfnPtr rv and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn rv' t t'. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ceqv \<Gamma> ret__unsigned_' rv' t t' (IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI) (?y'528 ntfnPtr ntfn rv')
 2. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?P528 ntfnPtr ntfn) (?Q528 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (?y'528 ntfnPtr ntfn (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting))
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q528 ntfnPtr ntfn)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. ?P528 ntfnPtr ntfn and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P528 ntfnPtr rv and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?P528 ntfnPtr ntfn) (?Q528 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. ?Q528 ntfnPtr ntfn)
 3. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. ?P528 ntfnPtr ntfn and ko_at' ntfn ntfnptr\<rbrace>
 4. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (?P528 ntfnPtr rv and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> ccorres dc xfdc (?Q687 ntfnPtr ntfn) (?Q'687 ntfnPtr ntfn) [SKIP] (case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn queue \<Rightarrow> do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x queue (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od | _ \<Rightarrow> return ()) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q687 ntfnPtr ntfn s \<and> s' \<in> ?Q'687 ntfnPtr ntfn
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>ntfnPtr ntfn. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R699 ntfnPtr ntfn) (?R''702 ntfnPtr ntfn) [SKIP] (return ()) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>ntfnPtr ntfn x2. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R700 ntfnPtr ntfn x2) (?R''703 ntfnPtr ntfn x2) [SKIP] (return ()) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>ntfnPtr ntfn x3. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 ntfnPtr ntfn x3) (?R''704 ntfnPtr ntfn x3) [SKIP] (do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x x3 (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R699 ntfnPtr ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R700 ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R''702 ntfnPtr ntfn} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''703 ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''704 ntfnPtr ntfn x}})
 5. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>ntfnPtr ntfn. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R699 (ntfn_Ptr ntfnptr) ntfn) (?R''702 (ntfn_Ptr ntfnptr) ntfn) [SKIP] (return ()) SKIP
 2. \<And>ntfnPtr ntfn x2. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R700 ntfnPtr ntfn x2) (?R''703 ntfnPtr ntfn x2) [SKIP] (return ()) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>ntfnPtr ntfn x3. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 ntfnPtr ntfn x3) (?R''704 ntfnPtr ntfn x3) [SKIP] (do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x x3 (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 4. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> ?R699 ntfnPtr ntfn s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R700 ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> ?R''702 ntfnPtr ntfn} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''703 ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''704 ntfnPtr ntfn x}})
 5. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ntfnPtr ntfn x2. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R700 ntfnPtr ntfn x2) (?R''703 ntfnPtr ntfn x2) [SKIP] (return ()) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>ntfnPtr ntfn x3. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 ntfnPtr ntfn x3) (?R''704 ntfnPtr ntfn x3) [SKIP] (do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x x3 (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R700 ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''703 ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''704 ntfnPtr ntfn x}})
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ntfnPtr ntfn x2. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x2\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R700 (ntfn_Ptr ntfnptr) ntfn x2) (?R''703 (ntfn_Ptr ntfnptr) ntfn x2) [SKIP] (return ()) SKIP
 2. \<And>ntfnPtr ntfn x3. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 ntfnPtr ntfn x3) (?R''704 ntfnPtr ntfn x3) [SKIP] (do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x x3 (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 3. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> ?R700 ntfnPtr ntfn x s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> ?R''703 ntfnPtr ntfn x}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''704 ntfnPtr ntfn x}})
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn x3. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 ntfnPtr ntfn x3) (?R''704 ntfnPtr ntfn x3) [SKIP] (do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x x3 (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''704 ntfnPtr ntfn x}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn list. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 ntfnPtr ntfn list) (?R''704 ntfnPtr ntfn list) [SKIP] (do setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
forM_x list (\<lambda>t. do setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od);
rescheduleRequired
od) (IF (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting) = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting THEN
  \<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfnPtr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) NtfnState_Idle);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfnPtr,SCAST(32 signed \<rightarrow> 32) 0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()
FI)
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''704 ntfnPtr ntfn x}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn list. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 (ntfn_Ptr ntfnptr) ntfn list) (?R''704 (ntfn_Ptr ntfnptr) ntfn list) [SKIP] (do y <- setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr);;
\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0);;
WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''704 ntfnPtr ntfn x}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn list. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 (ntfn_Ptr ntfnptr) ntfn list) (?R''704 (ntfn_Ptr ntfnptr) ntfn list) [SKIP] (do y <- setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>ret__unsigned :== CALL notification_ptr_get_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr);;
(\<acute>thread :== tcb_Ptr \<acute>ret__unsigned;;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
(CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
(CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))))))
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> ?R''704 ntfnPtr ntfn x}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 (ntfn_Ptr ntfnptr) ntfn list) (?G'747 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned \<inter> {s. ret__unsigned = ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr))))}) [SKIP] (do y <- setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>thread :== tcb_Ptr ret__unsigned;;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
(CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
(CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())))))
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'747 ntfnPtr ntfn x v}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 (ntfn_Ptr ntfnptr) ntfn list) (?G'950 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) [SKIP] (do y <- setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (\<acute>thread :== tcb_Ptr ret__unsigned;;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
(CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
(CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())))))
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> ?G'950 ntfnPtr ntfn x v}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 (ntfn_Ptr ntfnptr) ntfn list) (?G'961 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) [SKIP] (do y <- setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
(CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
(CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))))
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?G'961 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R701 (ntfn_Ptr ntfnptr) ntfn list) (?G'961 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) [SKIP] (do y <- setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn);
y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0);;
(WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()))
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> ?R701 ntfnPtr ntfn x s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?G'961 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P1150 (ntfn_Ptr ntfnptr) ntfn list) (?P'1143 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) [SKIP] (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) (CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0))
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (?P1150 ntfnPtr ntfn x and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> ?P'1143 ntfnPtr ntfn x v \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (ko_at' ntfn ntfnptr and invs') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<exists>(rv, \<sigma>')\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)}
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned \<sigma>. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> {s. (ko_at' ntfn ntfnptr and invs') \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>))))))}
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfn list \<sigma> x. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>ntfn list \<sigma> x. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some (?y1227 ntfn list \<sigma> x)
 2. \<And>ntfn list \<sigma> x y'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some (?y1227 ntfn list \<sigma> x); cnotification_relation (cslift x) (?y1227 ntfn list \<sigma> x) y'; cslift x (ntfn_Ptr ntfnptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 3. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 6. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 7. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 8. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 10. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfn list \<sigma> x y'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))))
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> ?x1244 ntfn list \<sigma> x y' t notification ta notificationa tb notificationb \<in> fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<sigma>)
 2. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> case ?x1244 ntfn list \<sigma> x y' t notification ta notificationa tb notificationb of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 3. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 6. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 7. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 8. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 10. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; (\<sigma>, x) \<in> rf_sr; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))\<rbrakk> \<Longrightarrow> case ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn))\<rparr>) of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)))); cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn))) (underlying_memory (ksMachineState \<sigma>)) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))) \<and> cready_queues_relation (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)))))) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))) \<and> set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))))) \<circ>\<^sub>m pd_pointer_to_asid_slot) \<and> cvariable_array_map_relation (map_to_tcbs ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)))) (\<lambda>x. 5) cte_Ptr (hrs_htd (t_hrs_' (globals x)))
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; ko_at' ntfn ntfnptr \<sigma>; invs' \<sigma>; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> notificationb)) ntfn_Ptr (cnotification_relation (cslift x))
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (10 subgoals):
 1. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; invs' \<sigma>; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) notificationb
 2. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; invs' \<sigma>; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub>
 3. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 6. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 7. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 8. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 10. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ntfnObj ntfn_ = Structures_H.ntfn.WaitingNtfn list_; invs' \<sigma>_; map_to_ntfns (ksPSpace \<sigma>_) ntfnptr = Some ntfn_; cnotification_relation (cslift x_) ntfn_ y'_; cslift x_ (ntfn_Ptr ntfnptr) = Some y'_; notification_lift notification_ = notification_lift y'_\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals x_)); notification_lift notificationa_ = notification_lift y'_\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa_) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals x_))); notification_lift notificationb_ = notification_lift y'_\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb_) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa_) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals x_)))); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cnotification_relation (cslift x_) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn_) notificationb_ proof (prove)
goal (9 subgoals):
 1. \<And>ntfn list \<sigma> x y' t notification ta notificationa tb notificationb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; invs' \<sigma>; map_to_ntfns (ksPSpace \<sigma>) ntfnptr = Some ntfn; cnotification_relation (cslift x) ntfn y'; cslift x (ntfn_Ptr ntfnptr) = Some y'; notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)); notification_lift notificationa = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x))); notification_lift notificationb = notification_lift y'\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals x)))); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); armKSNextASID_' (globals x) = armKSNextASID (ksArchState \<sigma>); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>)) (armKSHWASIDTable_' (globals x)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>)) (armKSASIDTable_' (globals x)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>) = irq_masks (phantom_machine_state_' (globals x)); irq_state (ksMachineState \<sigma>) = irq_state (phantom_machine_state_' (globals x)); device_state (ksMachineState \<sigma>) = device_state (phantom_machine_state_' (globals x)); exclusive_state (ksMachineState \<sigma>) = exclusive_state (phantom_machine_state_' (globals x)); machine_state_rest (ksMachineState \<sigma>) = machine_state_rest (phantom_machine_state_' (globals x)); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn) then set (ntfnQueue (ntfnObj ntfn)) else {}))\<^esub>
 2. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>ntfnObj ntfn_ = Structures_H.ntfn.WaitingNtfn list_; invs' \<sigma>_; map_to_ntfns (ksPSpace \<sigma>_) ntfnptr = Some ntfn_; cnotification_relation (cslift x_) ntfn_ y'_; cslift x_ (ntfn_Ptr ntfnptr) = Some y'_; notification_lift notification_ = notification_lift y'_\<lparr>notification_CL.state_CL := 0\<rparr>; t_hrs_' (globals t_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals x_)); notification_lift notificationa_ = notification_lift y'_\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa_) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals x_))); notification_lift notificationb_ = notification_lift y'_\<lparr>notification_CL.state_CL := 0, ntfnQueue_head_CL := 0, ntfnQueue_tail_CL := 0\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationb_) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notificationa_) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals x_)))); cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); armKSNextASID_' (globals x_) = armKSNextASID (ksArchState \<sigma>_); armKSKernelVSpace_C = armKSKernelVSpace (ksArchState \<sigma>_); array_relation ((=) \<circ> option_to_0) 0xFF (armKSHWASIDTable (ksArchState \<sigma>_)) (armKSHWASIDTable_' (globals x_)); array_relation ((=) \<circ> option_to_ptr) (2 ^ local.asid_high_bits - 1) (armKSASIDTable (ksArchState \<sigma>_)) (armKSASIDTable_' (globals x_)); asid_map_pd_to_hwasids (armKSASIDMap (ksArchState \<sigma>_)) = set_option \<circ> (pde_stored_asid \<circ>\<^sub>m cslift x_ \<circ>\<^sub>m pd_pointer_to_asid_slot); armKSGlobalPD (ksArchState \<sigma>_) = symbol_table ''armKSGlobalPD''; armKSGlobalPTs (ksArchState \<sigma>_) = [symbol_table ''armKSGlobalPT'']; irq_masks (ksMachineState \<sigma>_) = irq_masks (phantom_machine_state_' (globals x_)); irq_state (ksMachineState \<sigma>_) = irq_state (phantom_machine_state_' (globals x_)); device_state (ksMachineState \<sigma>_) = device_state (phantom_machine_state_' (globals x_)); exclusive_state (ksMachineState \<sigma>_) = exclusive_state (phantom_machine_state_' (globals x_)); machine_state_rest (ksMachineState \<sigma>_) = machine_state_rest (phantom_machine_state_' (globals x_)); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr\<rbrakk> \<Longrightarrow> cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn_) then set (ntfnQueue (ntfnObj ntfn_)) else {}))\<^esub> = cslift x_|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj ntfn_) then set (ntfnQueue (ntfnObj ntfn_)) else {}))\<^esub> proof (prove)
goal (8 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned rv' t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc()) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 2. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (?d'1140 ntfnPtr ntfn list ret__unsigned rv')
 3. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 5. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 6. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 8. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 ntfnPtr ntfn list ret__unsigned rv) (?Q'1140 ntfnPtr ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 3. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 4. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 5. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1140 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv) (?Q'1140 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv rv') [SKIP] (do y <- mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list;
rescheduleRequired
od) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD;;
CALL rescheduleRequired_'proc())
 2. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>?Q1140 ntfnPtr ntfn list ret__unsigned\<rbrace>
 3. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 4. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 5. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (11 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1313 ntfnPtr ntfn list ret__unsigned rv rv') (?xf'1313 ntfnPtr ntfn list ret__unsigned rv rv') (?P1319 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv) (?Q'1140 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv rv') [] (mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list) (WHILE \<acute>thread \<noteq> NULL DO
  CALL setThreadState_'proc(\<acute>thread,SCAST(32 signed \<rightarrow> 32) ThreadState_Restart);;
CALL tcbSchedEnqueue_'proc(\<acute>thread);;
Guard C_Guard {s. s \<Turnstile>\<^sub>c thread_' s} (\<acute>thread :== h_val (hrs_mem \<acute>t_hrs) (PTR(tcb_C ptr) &(\<acute>thread\<rightarrow>[''tcbEPNext_C''])))
OD)
 2. \<And>ntfnPtr ntfn list ret__unsigned rv rv' rv'a t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1313 ntfnPtr ntfn list ret__unsigned rv rv') rv'a t t' (CALL rescheduleRequired_'proc()) (?d'1313 ntfnPtr ntfn list ret__unsigned rv rv' rv'a)
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv' rva rv'a. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'; ?r'1313 ntfnPtr ntfn list ret__unsigned rv rv' rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1313 ntfnPtr ntfn list ret__unsigned rv rv' rva) (?Q'1313 ntfnPtr ntfn list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (?d'1313 ntfnPtr ntfn list ret__unsigned rv rv' rv'a)
 4. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1317 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q1313 ntfnPtr ntfn list ret__unsigned rv rv'\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1313 ntfnPtr ntfn list ret__unsigned rv rv') (?xf'1313 ntfnPtr ntfn list ret__unsigned rv rv') (?Q'1313 ntfnPtr ntfn list ret__unsigned rv rv')
 6. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>\<lambda>a. ?P1319 ntfnPtr ntfn list ret__unsigned a and ?R1317 ntfnPtr ntfn list ret__unsigned a\<rbrace>
 7. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1140 ntfnPtr ntfn list ret__unsigned rv (xfdc s)}
 8. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 9. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 10. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned rv rv' rv'a t t'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (CALL rescheduleRequired_'proc()) (?d'1313 ntfnPtr ntfn list ret__unsigned rv rv' rv'a)
 2. \<And>ntfnPtr ntfn list ret__unsigned rv rv' rva rv'a. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1313 ntfnPtr ntfn list ret__unsigned rv rv' rva) (?Q'1313 ntfnPtr ntfn list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (?d'1313 ntfnPtr ntfn list ret__unsigned rv rv' rv'a)
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1317 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q1313 ntfnPtr ntfn list ret__unsigned rv rv'\<rbrace>
 4. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1313 ntfnPtr ntfn list ret__unsigned rv rv')
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R1317 ntfnPtr ntfn list ret__unsigned a\<rbrace>
 6. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 7. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 8. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 9. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 10. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (9 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned rv rv' rva rv'a. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1313 ntfnPtr ntfn list ret__unsigned rv rv' rva) (?Q'1313 ntfnPtr ntfn list ret__unsigned rv rv' rva rv'a) [SKIP] rescheduleRequired (CALL rescheduleRequired_'proc())
 2. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1317 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>?Q1313 ntfnPtr ntfn list ret__unsigned rv rv'\<rbrace>
 3. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1313 ntfnPtr ntfn list ret__unsigned rv rv')
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R1317 ntfnPtr ntfn list ret__unsigned a\<rbrace>
 5. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 6. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 7. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 8. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 9. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1317 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rva. Invariants_H.valid_queues and (\<lambda>s. weak_sch_act_wf (ksSchedulerAction s) s) and valid_objs'\<rbrace>
 2. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 3. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and ?R1317 ntfnPtr ntfn list ret__unsigned a\<rbrace>
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 5. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 6. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 8. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (8 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?P'1347 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned rv\<rbrace> mapM_x (\<lambda>t. do y <- setThreadState Structures_H.thread_state.Restart t;
tcbSchedEnqueue t
od) list \<lbrace>\<lambda>rv s. weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s\<rbrace>
 2. \<And>ntfnPtr ntfn list ret__unsigned rv rv'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s. s \<in> UNIV})
 3. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>b. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) b \<and> ?P'1347 ntfnPtr ntfn list ret__unsigned a b)\<rbrace>
 4. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 5. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 6. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 7. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 8. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>ntfn list. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list \<Longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rva rv'a. UNIV)
 2. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)\<rbrace>
 3. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 4. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 5. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 6. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 7. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<lbrace>?R1148 (ntfn_Ptr ntfnptr) ntfn list\<rbrace> setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) \<lbrace>\<lambda>a. (\<lambda>a. valid_objs' a \<and> Invariants_H.valid_queues a \<and> (\<forall>t\<in>set list. tcb_at' t a \<and> t \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a) and (\<lambda>a. (Invariants_H.valid_queues and valid_objs' and (\<lambda>s. \<forall>t\<in>set list. tcb_at' t s)) a \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> valid_objs' a)\<rbrace>
 2. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 3. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and ?R1148 ntfnPtr ntfn x) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 4. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 5. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 6. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfnPtr ntfn list ret__unsigned. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn list\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F1140 ntfnPtr ntfn list ret__unsigned\<^esub> (?R'1142 (ntfn_Ptr ntfnptr) ntfn list ret__unsigned) CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_head_'proc(ntfn_Ptr ntfnptr,0);;
CALL notification_ptr_set_ntfnQueue_tail_'proc(ntfn_Ptr ntfnptr,0) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s'. \<exists>p. ep_queue_relation (cslift s') list p (thread_' s')}}
 2. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and (\<lambda>a. (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) a)) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> ?R'1142 ntfnPtr ntfn x v}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfnPtr ntfn s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; (invs' and ko_at' ntfn ntfnptr) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> True) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> (ko_at' ntfn ntfnptr and invs' and (\<lambda>a. (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) a \<and> Invariants_H.valid_queues a \<and> (\<forall>x\<in>set x. tcb_at' x a \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction a) a \<and> Invariants_H.valid_queues a \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) a \<and> (\<forall>x\<in>set x. tcb_at' x a) \<and> weak_sch_act_wf (ksSchedulerAction a) a \<and> (valid_objs' and valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn)) a)) s)) \<and> s' \<in> {s. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<longrightarrow> s \<in> UNIV} \<inter> ({s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.ActiveNtfn x \<longrightarrow> s \<in> UNIV}} \<inter> {s. \<forall>x. s \<in> {s. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s \<in> {s. \<forall>v v'. v = ntfnQueue_head_CL (notification_lift (the (cslift (notification_ptr_'_update (\<lambda>_. ntfnPtr) s) (notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s))))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. s \<in> {s. v = ntfnQueue_head_CL (notification_lift (the (cslift s ntfnPtr)))} \<longrightarrow> s \<in> {s. thread_'_update (\<lambda>_. tcb_Ptr v) s \<in> UNIV \<inter> {s. s \<Turnstile>\<^sub>c ntfnPtr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s ntfnPtr))\<lparr>notification_CL.state_CL := 0 && mask 2\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update ntfnPtr notification) (t_hrs_' (globals s))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfnPtr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t ntfnPtr))\<lparr>ntfnQueue_head_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update ntfnPtr notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfnPtr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta ntfnPtr))\<lparr>ntfnQueue_tail_CL := 0 && ~~ mask 4\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update ntfnPtr notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<forall>rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (thread_' s))))))}}}}} \<inter> {s. notification_ptr_'_update (\<lambda>_. ntfnPtr) s \<Turnstile>\<^sub>c notification_ptr_' (notification_ptr_'_update (\<lambda>_. ntfnPtr) s)}}})
 2. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 4. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s' (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s' (ntfn_Ptr ntfnptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr)
 2. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 4. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>ntfn s s'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s\<rbrakk> \<Longrightarrow> map_to_ntfns (ksPSpace s) (?x1536 ntfn s s') = Some (?y1536 ntfn s s')
 2. \<And>ntfn s s' y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s; map_to_ntfns (ksPSpace s) (?x1536 ntfn s s') = Some (?y1536 ntfn s s'); cnotification_relation (cslift s') (?y1536 ntfn s s') y'; cslift s' (ntfn_Ptr (?x1536 ntfn s s')) = Some y'\<rbrakk> \<Longrightarrow> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s' (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s' (ntfn_Ptr ntfnptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr)
 3. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 4. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 5. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn s s' y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s; map_to_ntfns (ksPSpace s) ntfnptr = Some ntfn; cnotification_relation (cslift s') ntfn y'; cslift s' (ntfn_Ptr ntfnptr) = Some y'\<rbrakk> \<Longrightarrow> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s' (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s' (ntfn_Ptr ntfnptr)))))))))) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr)
 2. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 4. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn s s' y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s; map_to_ntfns (ksPSpace s) ntfnptr = Some ntfn; cnotification_relation (cslift s') ntfn y'; cslift s' (ntfn_Ptr ntfnptr) = Some y'; (\<forall>ko. projectKO_opt ko = Some ntfn \<longrightarrow> KONotification ntfn = ko) \<longrightarrow> valid_obj' (KONotification ntfn) s\<rbrakk> \<Longrightarrow> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s \<and> Invariants_H.valid_queues s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s \<and> valid_ntfn' (ntfnObj_update (\<lambda>_. Structures_H.ntfn.IdleNtfn) ntfn) s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (ntfnQueue_head_CL (notification_lift y'))))))) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr)
 2. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 4. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>ntfn s s' y'. \<lbrakk>(s, s') \<in> rf_sr; invs' s; ko_at' ntfn ntfnptr s; map_to_ntfns (ksPSpace s) ntfnptr = Some ntfn; cnotification_relation (cslift s') ntfn y'; cslift s' (ntfn_Ptr ntfnptr) = Some y'; case ntfnObj ntfn of Structures_H.ntfn.WaitingNtfn ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s) \<and> distinct ts \<and> (case ntfnBoundTCB ntfn of None \<Rightarrow> True | Some tcb \<Rightarrow> ts = [tcb]) | _ \<Rightarrow> True; valid_bound_tcb' (ntfnBoundTCB ntfn) s\<rbrakk> \<Longrightarrow> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> valid_objs' s \<and> Invariants_H.valid_queues s \<and> (\<forall>x\<in>set x. tcb_at' x s \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s) s \<and> Invariants_H.valid_queues s \<and> valid_objs' s \<and> (\<forall>x\<in>set x. tcb_at' x s) \<and> weak_sch_act_wf (ksSchedulerAction s) s \<and> valid_objs' s) \<and> (\<forall>x. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift y'\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s'))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (ntfnQueue_head_CL (notification_lift y'))))))) \<and> s' \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr)
 2. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 3. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 4. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<lbrakk>(s_, s'_) \<in> rf_sr; invs' s_; ko_at' ntfn_ ntfnptr s_; map_to_ntfns (ksPSpace s_) ntfnptr = Some ntfn_; cnotification_relation (cslift s'_) ntfn_ y'_; cslift s'_ (ntfn_Ptr ntfnptr) = Some y'_; case ntfnObj ntfn_ of Structures_H.ntfn.WaitingNtfn ts \<Rightarrow> ts \<noteq> [] \<and> (\<forall>t\<in>set ts. tcb_at' t s_) \<and> distinct ts \<and> (case ntfnBoundTCB ntfn_ of None \<Rightarrow> True | Some tcb \<Rightarrow> ts = [tcb]) | _ \<Rightarrow> True; valid_bound_tcb' (ntfnBoundTCB ntfn_) s_\<rbrakk> \<Longrightarrow> (\<forall>x. ntfnObj ntfn_ = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> valid_objs' s_ \<and> Invariants_H.valid_queues s_ \<and> (\<forall>x\<in>set x. tcb_at' x s_ \<and> x \<noteq> 0) \<and> sch_act_wf (ksSchedulerAction s_) s_ \<and> Invariants_H.valid_queues s_ \<and> valid_objs' s_ \<and> (\<forall>x\<in>set x. tcb_at' x s_) \<and> weak_sch_act_wf (ksSchedulerAction s_) s_ \<and> valid_objs' s_) \<and> (\<forall>x. ntfnObj ntfn_ = Structures_H.ntfn.WaitingNtfn x \<longrightarrow> s'_ \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift y'_\<lparr>notification_CL.state_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals s'_))) \<longrightarrow> t \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift t (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := 0\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. (\<exists>notification. notification_lift notification = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_tail_CL := 0\<rparr> \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>p. ep_queue_relation (cslift t) x p (tcb_Ptr (ntfnQueue_head_CL (notification_lift y'_))))))) \<and> s'_ \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr) proof (prove)
goal (3 subgoals):
 1. \<And>ntfnPtr ntfn. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Idle | Structures_H.ntfn.ActiveNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Active | Structures_H.ntfn.WaitingNtfn x \<Rightarrow> SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting)) ret__unsigned_' (\<lambda>rv rv'. UNIV)
 2. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 3. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>ntfnPtr. ntfnPtr = ntfn_Ptr ntfnptr \<Longrightarrow> \<lbrace>?Q515 ntfnPtr\<rbrace> getNotification ntfnptr \<lbrace>\<lambda>ntfn. invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr\<rbrace>
 2. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q515 ntfnPtr s \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal (1 subgoal):
 1. \<And>ntfnPtr s s'. \<lbrakk>ntfnPtr = ntfn_Ptr ntfnptr; (s, s') \<in> rf_sr; invs' s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (\<forall>ntfn. ko_at' ntfn ntfnptr s \<longrightarrow> (invs' and ko_at' ntfn ntfnptr and ko_at' ntfn ntfnptr) s) \<and> s' \<in> {s'. \<forall>rv s. (s, s') \<in> rf_sr \<and> (invs' and ko_at' rv ntfnptr and ko_at' rv ntfnptr) s \<longrightarrow> s' \<in> UNIV} proof (prove)
goal:
No subgoals!