theory Ipc_C

lemma receiveSignal_enqueue_ccorres_helper:
  notes option.case_cong_weak [cong]
        is_aligned_neg_mask_eq[simp del]
        is_aligned_neg_mask_weaken[simp del]
  shows
  "ccorres dc xfdc (valid_pspace'
                and (\<lambda>s. sym_refs ((state_refs_of' s)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s ntfnptr. snd r = NTFNBound})))
                and st_tcb_at'  (\<lambda>st. isBlockedOnNotification st \<and>
                                      waitingOnNotification st = ntfnptr) thread
                and ko_at' (ntfn::Structures_H.notification) ntfnptr
                and K ((ntfnObj ntfn = IdleNtfn \<and> queue = [thread]) \<or>
                       (\<exists>q. ntfnObj ntfn = WaitingNtfn q \<and> thread \<notin> set q \<and>
                            queue = q @ [thread])))
           UNIV hs
           (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.WaitingNtfn queue) ntfn)
           (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue(ntfn_Ptr ntfnptr);;
            (\<acute>ntfn_queue :== CALL tcbEPAppend(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
             (CALL notification_ptr_set_state(ntfn_Ptr ntfnptr, scast NtfnState_Waiting);;
              CALL ntfn_ptr_set_queue(ntfn_Ptr ntfnptr,\<acute>ntfn_queue))))" unfolding K_def apply (rule ccorres_gen_asm) apply (rule ccorres_from_vcg) apply (rule allI, rule conseqPre, vcg) apply (clarsimp split del: if_split) apply (frule cmap_relation_ntfn) apply (erule (1) cmap_relation_ko_atE) apply (rule conjI) apply (erule h_t_valid_clift) apply (frule(1) st_tcb_at_h_t_valid) apply (frule pred_tcb_at') apply (rule impI) apply (rule_tac x="init queue" in exI) apply (frule(1) ko_at_valid_ntfn' [OF _ valid_pspace_valid_objs']) apply (frule is_aligned_tcb_ptr_to_ctcb_ptr) apply (rule conjI) apply (rule_tac x=\<sigma> in exI) apply (simp add: cnotification_relation_def Let_def) apply (case_tac "ntfnObj ntfn", simp_all add: init_def valid_ntfn'_def)[1] apply (subgoal_tac "sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace :=
                               (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>))") prefer 2 apply (clarsimp simp: state_refs_of'_upd ko_wp_at'_def ntfnBound_state_refs_equivalence
                         obj_at'_def projectKOs objBitsKO_def) apply (subgoal_tac "ko_at' (NTFN (WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace :=
                             (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)") prefer 2 apply (clarsimp simp: obj_at'_def projectKOs objBitsKO_def ps_clear_upd) apply (intro conjI impI allI) apply (fastforce simp: h_t_valid_clift) apply (fastforce simp: h_t_valid_clift) apply (case_tac "ntfnObj ntfn", simp_all add: NtfnState_Idle_def NtfnState_Waiting_def)[1]
   \<comment> \<open>IdleNtfn case\<close> apply clarsimp apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (simp add: setNotification_def split_def) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def Let_def init_def
                        cpspace_relation_def update_ntfn_map_tos
                        typ_heap_simps') apply (elim conjE) apply (intro conjI)
            \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
           \<comment> \<open>ep relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cendpoint_relation_ntfn_queue, assumption+) apply (simp add: isWaitingNtfn_def) apply simp apply (frule_tac x=p in map_to_ko_atI, clarsimp, clarsimp) apply (erule(2) map_to_ko_at_updI') apply (clarsimp simp: objBitsKO_def) apply (clarsimp simp: obj_at'_def projectKOs)
          \<comment> \<open>ntfn relation\<close> apply (rule cpspace_relation_ntfn_update_ntfn', assumption+) apply (case_tac "ntfn", simp_all)[1] apply (clarsimp simp: cnotification_relation_def Let_def
                                 mask_def [where n=2] NtfnState_Waiting_def) subgoal by (fastforce simp: tcb_queue_relation'_def is_aligned_neg_mask_weaken
                                 valid_ntfn'_def
                           dest: tcb_queue_relation_next_not_NULL) apply (simp add: isWaitingNtfn_def)
         \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) subgoal by (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption
  \<comment> \<open>WaitingNtfn case\<close> apply clarsimp apply (frule null_ep_queue [simplified comp_def] null_ep_queue) apply (simp add: setNotification_def split_def) apply (rule bexI [OF _ setObject_eq]) apply (simp add: rf_sr_def cstate_relation_def init_def Let_def
                       cpspace_relation_def update_ntfn_map_tos
                       typ_heap_simps') apply (elim conjE) apply (intro conjI)
           \<comment> \<open>tcb relation\<close> apply (erule ctcb_relation_null_queue_ptrs) apply (clarsimp simp: comp_def)
          \<comment> \<open>ep relation\<close> apply (erule iffD1 [OF cmap_relation_cong, OF refl refl, rotated -1]) apply simp apply (rule cendpoint_relation_ntfn_queue, assumption+) apply (simp add: isWaitingNtfn_def) apply simp apply (frule_tac x=p in map_to_ko_atI, clarsimp, clarsimp) apply (erule(2) map_to_ko_at_updI') apply (clarsimp simp: objBitsKO_def) apply (clarsimp simp: obj_at'_def projectKOs)
         \<comment> \<open>ntfn relation\<close> apply (rule cpspace_relation_ntfn_update_ntfn', assumption+) apply (case_tac "ntfn", simp_all)[1] apply (clarsimp simp: cnotification_relation_def Let_def
                                mask_def [where n=2] NtfnState_Waiting_def
                         split: if_split) apply (fastforce simp: tcb_queue_relation'_def is_aligned_neg_mask_weaken) apply (simp add: isWaitingNtfn_def)
        \<comment> \<open>queue relation\<close> apply (rule cready_queues_relation_null_queue_ptrs, assumption+) apply (clarsimp simp: comp_def) apply (simp add: carch_state_relation_def typ_heap_simps') apply (simp add: cmachine_state_relation_def) apply (simp add: h_t_valid_clift_Some_iff) apply (simp add: objBits_simps') apply (simp add: objBits_simps) apply assumption done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s ntfnptr. snd r = NTFNBound}))) and st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread and ko_at' ntfn ntfnptr and K (ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]))) UNIV hs (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfnptr);;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfnptr,\<acute>ntfn_queue)))) proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s ntfnptr. snd r = NTFNBound}))) and st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread and ko_at' ntfn ntfnptr and (\<lambda>y. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]))) UNIV hs (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfnptr);;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfnptr,\<acute>ntfn_queue)))) proof (prove)
goal (1 subgoal):
 1. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]) \<Longrightarrow> ccorres dc xfdc (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s ntfnptr. snd r = NTFNBound}))) and st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread and ko_at' ntfn ntfnptr) UNIV hs (setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) (\<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfnptr);;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfnptr,\<acute>ntfn_queue)))) proof (prove)
goal (1 subgoal):
 1. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]) \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s ntfnptr. snd r = NTFNBound}))) and st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread and ko_at' ntfn ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ntfn_queue :== CALL ntfn_ptr_get_queue_'proc(ntfn_Ptr ntfnptr);;
(\<acute>ntfn_queue :== CALL tcbEPAppend_'proc(tcb_ptr_to_ctcb_ptr thread,\<acute>ntfn_queue);;
(CALL notification_ptr_set_state_'proc(ntfn_Ptr ntfnptr,SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting);;
CALL ntfn_ptr_set_queue_'proc(ntfn_Ptr ntfnptr,\<acute>ntfn_queue))) {s. \<exists>(rv, \<sigma>')\<in>fst ((setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> dc rv (xfdc s)} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma>. ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]) \<Longrightarrow> {s. (valid_pspace' and (\<lambda>s. sym_refs ((state_refs_of' s)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' s ntfnptr. snd r = NTFNBound}))) and st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread and ko_at' ntfn ntfnptr) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr))))) \<longrightarrow> (\<exists>queuea. (\<exists>ta. (ta, queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) (tcb_'_update (\<lambda>_. tcb_ptr_to_ctcb_ptr thread) (ntfn_queue_'_update (\<lambda>_. ret__struct_tcb_queue_C_' t) s))) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb ta) \<and> distinct queuea \<and> tcb_at' (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread)) ta \<and> ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread) \<notin> set queuea \<and> ep_queue_relation' (cslift s) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr))))) = NULL then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread)]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread) # queuea))\<^esub> = cslift s|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ctcb_ptr_to_tcb_ptr (tcb_ptr_to_ctcb_ptr thread) # queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>x. map_option tcb_null_ep_ptrs (cslift s x)) \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> cslift t = cslift s \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals s)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals s)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> s \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr))))) = NULL then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift s (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((setNotification ntfnptr $ ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). (\<sigma>', s\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr \<and> dc rv (xfdc (s\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>))))))))} proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> ((\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr
 2. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>\<rbrakk> \<Longrightarrow> (\<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<longrightarrow> (\<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))\<rbrakk> \<Longrightarrow> \<exists>queuea. (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set queuea. tcb_at' tcb t) \<and> distinct queuea \<and> tcb_at' thread t \<and> thread \<notin> set queuea \<and> ep_queue_relation' (cslift x) queuea (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (queuea @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set queuea))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb t) \<and> distinct (init queue) \<and> tcb_at' thread t \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb t) \<and> distinct (init queue) \<and> tcb_at' thread t \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> (\<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb t) \<and> distinct (init queue) \<and> tcb_at' thread t \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))) \<and> (\<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<exists>t. (t, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb t) \<and> distinct (init queue) \<and> tcb_at' thread t \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> (\<sigma>, x) \<in> rf_sr \<and> (\<forall>tcb\<in>set (init queue). tcb_at' tcb \<sigma>) \<and> distinct (init queue) \<and> tcb_at' thread \<sigma> \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))))
 2. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; (case ntfnObj ntfn of Structures_H.ntfn.IdleNtfn \<Rightarrow> notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))) | Structures_H.ntfn.ActiveNtfn msgid \<Rightarrow> notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Active \<and> msgid = ntfnMsgIdentifier_CL (notification_lift ko') \<and> ep_queue_relation' (cslift x) [] (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))) | Structures_H.ntfn.WaitingNtfn q \<Rightarrow> notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting \<and> ep_queue_relation' (cslift x) q (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')))) \<and> option_to_ctcb_ptr (ntfnBoundTCB ntfn) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko')); x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> (\<forall>tcb\<in>set (init queue). tcb_at' tcb \<sigma>) \<and> distinct (init queue) \<and> thread \<notin> set (init queue) \<and> ep_queue_relation' (cslift x) (init queue) (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')))
 2. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>))
 2. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>))\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr)))
 2. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>))\<rbrakk> \<Longrightarrow> ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>) proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>))\<rbrakk> \<Longrightarrow> ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)
 2. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko'. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)\<rbrakk> \<Longrightarrow> \<forall>t. head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))) \<longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>ta. (\<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) \<longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr \<and> (\<forall>tb. (\<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))) \<longrightarrow> (\<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr))) proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)))\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr
 2. \<And>\<sigma> x ko' t ta. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))\<rbrakk> \<Longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr
 3. \<And>\<sigma> x ko' t ta tb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))\<rbrakk> \<Longrightarrow> ta \<Turnstile>\<^sub>c ntfn_Ptr ntfnptr
 2. \<And>\<sigma> x ko' t ta tb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb. \<lbrakk>ntfnObj ntfn = Structures_H.ntfn.IdleNtfn \<and> queue = [thread] \<or> (\<exists>q. ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn q \<and> thread \<notin> set q \<and> queue = q @ [thread]); valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := set queue \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr))))); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn queue) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init queue @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init queue)))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))\<lparr>notification_CL.state_CL := SCAST(32 signed \<rightarrow> 32) NtfnState_Waiting && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn queue) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (init [thread] @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn) \<sigma>). (snd xa, x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))\<rparr>), x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 6. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 6. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 6. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_eps (ksPSpace \<sigma>) p = Some a; map_to_eps (ksPSpace \<sigma>) p = Some a'; cslift x (ep_Ptr p) = Some b; cslift x (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift t) a' b'
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift t) a b
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (12 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isWaitingNtfn (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr271 \<sigma> x ko' t ta tb tc notification ntfn' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 10. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr271 \<sigma> x ko' t ta tb tc notification ntfn' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr271 \<sigma> x ko' t ta tb tc notification ntfn' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> ko_at' a (?epptr271 \<sigma> x ko' t ta tb tc notification ntfn' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ep_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> objBitsKO (injectKOS ntfn) = objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ep_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> p \<noteq> ntfnptr
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' p a a' b b'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ep_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> p \<noteq> ntfnptr
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 9. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))\<rparr>))
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift t) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn) ntfn'
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))) else {}))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift t) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn) ntfn'
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; head_C (ret__struct_tcb_queue_C_' tc) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = NULL; notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1, ntfnQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; notification_CL.state_CL (notification_lift ko') = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle; ntfnQueue_tail_CL (notification_lift ko') = 0; ntfnQueue_head_CL (notification_lift ko') = 0; option_to_ctcb_ptr (ntfnBoundTCB ntfn) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko'))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift t) [thread] (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4)) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4))
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 10. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>_; sym_refs ((state_refs_of' \<sigma>_)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma>_ ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>_; ko_at' ntfn ntfnptr \<sigma>_; cslift x_ (ntfn_Ptr ntfnptr) = Some ko'_; x_ \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>_; valid_ntfn' ntfn \<sigma>_; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>_\<lparr>ksPSpace := (ksPSpace \<sigma>_)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>_\<lparr>ksPSpace := (ksPSpace \<sigma>_)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t_) = tcb_ptr_to_ctcb_ptr thread; head_C (ret__struct_tcb_queue_C_' tc_) = NULL; StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc_) = NULL; notification_lift notification_ = notification_lift ko'_\<lparr>notification_CL.state_CL := 1\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals t_)); notification_lift ntfn'_ = notification_lift ko'_\<lparr>notification_CL.state_CL := 1, ntfnQueue_head_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn'_) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals t_))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t_) [thread] (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr thread); cslift t_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; hrs_htd (t_hrs_' (globals t_)) = hrs_htd (t_hrs_' (globals x_)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x_)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_; notification_CL.state_CL (notification_lift ko'_) = SCAST(32 signed \<rightarrow> 32) NtfnState_Idle; ntfnQueue_tail_CL (notification_lift ko'_) = 0; ntfnQueue_head_CL (notification_lift ko'_) = 0; option_to_ctcb_ptr (ntfnBoundTCB ntfn) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko'_))\<rbrakk> \<Longrightarrow> ep_queue_relation' (cslift t_) [thread] (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4)) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4)) proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn [thread]) ntfn))) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 9. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 8. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 8. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>_; sym_refs ((state_refs_of' \<sigma>_)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma>_ ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>_; ko_at' ntfn ntfnptr \<sigma>_; cslift x_ (ntfn_Ptr ntfnptr) = Some ko'_; cnotification_relation (cslift x_) ntfn ko'_; x_ \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>_; valid_ntfn' ntfn \<sigma>_; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>_\<lparr>ksPSpace := (ksPSpace \<sigma>_)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>_\<lparr>ksPSpace := (ksPSpace \<sigma>_)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t_) = (if ntfnQueue_head_CL (notification_lift ko'_) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x_ (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc_) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'_)); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc_) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'_)); notification_lift notification_ = notification_lift ko'_\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals t_)); notification_lift ntfn'_ = notification_lift ko'_\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko'_) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x_ (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb_) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn'_) (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification_) (t_hrs_' (globals t_))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t_) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t_) [thread] (if ntfnQueue_head_CL (notification_lift ko'_) = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x_ (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x_|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t_ x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x_ xa)); cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; cslift t_ = cslift x_; hrs_htd (t_hrs_' (globals t_)) = hrs_htd (t_hrs_' (globals x_)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x_)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t_)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t_ x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x_ xa)); cmap_relation (ctes_of \<sigma>_) (cslift x_) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>_)) (cslift x_) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>_)) (cslift x_) ep_Ptr (cendpoint_relation (cslift x_)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>_)) (cslift x_) ntfn_Ptr (cnotification_relation (cslift x_)); cmap_relation (map_to_pdes (ksPSpace \<sigma>_)) (cslift x_) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>_)) (cslift x_) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>_)) (cslift x_) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>_) (underlying_memory (ksMachineState \<sigma>_))) (cslift x_) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>_)) (c_h_t_valid x_) pt_Ptr; cready_queues_relation (cslift x_) (ksReadyQueues_' (globals x_)) (ksReadyQueues \<sigma>_); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>_) (t_hrs_' (globals x_)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x_)) (ksReadyQueuesL1Bitmap \<sigma>_); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x_)) (ksReadyQueuesL2Bitmap \<sigma>_); ksCurThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>_); ksIdleThread_' (globals x_) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>_); cinterrupt_relation (ksInterruptState \<sigma>_) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x_)); cscheduler_action_relation (ksSchedulerAction \<sigma>_) (ksSchedulerAction_' (globals x_)); carch_state_relation (ksArchState \<sigma>_) (globals x_); cmachine_state_relation (ksMachineState \<sigma>_) (globals x_); cte_array_relation \<sigma>_ (globals x_); tcb_cte_array_relation \<sigma>_ (globals x_); apsnd fst (ghost'state_' (globals x_)) = (gsUserPages \<sigma>_, gsCNodes \<sigma>_); ghost_size_rel (ghost'state_' (globals x_)) (gsMaxObjectSize \<sigma>_); ksWorkUnitsCompleted_' (globals x_) = ksWorkUnitsCompleted \<sigma>_; x_ \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x_ \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x_))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>_) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x_) = word_of_nat (ksDomScheduleIdx \<sigma>_); ksCurDomain_' (globals x_) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>_); ksDomainTime_' (globals x_) = ksDomainTime \<sigma>_\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t_ = map_option tcb_null_ep_ptrs \<circ> cslift x_ proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 7. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) [thread] (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub> = cslift x|\<^bsub>(- {tcb_ptr_to_ctcb_ptr thread})\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 6. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' val old ptr ptr' next. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 5. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 4. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn' v v'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 3. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb tc notification ntfn'. \<lbrakk>queue = [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound})); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn [thread]) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.IdleNtfn; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (init [thread] @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set (init [thread])))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P216 \<sigma> x ko' t ta tb tc notification ntfn') ntfnptr \<sigma>
 2. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb x3. \<lbrakk>thread \<notin> set x3 \<and> queue = x3 @ [thread]; valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; \<exists>t. head_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) \<and> StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread \<and> ep_queue_relation' (cslift t) (x3 @ [thread]) (head_C (ret__struct_tcb_queue_C_' t)) (StateRelation_C.end_C (ret__struct_tcb_queue_C_' t)) \<and> cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> \<and> (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)) \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> cslift t = cslift x \<and> hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)) \<and> (\<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))); \<exists>notification. notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr> \<and> t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); \<exists>ntfn'. notification_lift ntfn' = notification_lift (the (cslift ta (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr> \<and> t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (t_hrs_' (globals ta)); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals tb)\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setNotification ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setObject ntfnptr (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) \<sigma>). (snd xa, x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> (snd ((), \<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> injectKOS (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))\<rparr>), x\<lparr>ntfn_queue_' := ret__struct_tcb_queue_C_' t, globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)) \<and> cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)) \<and> cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation \<and> cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation \<and> cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation \<and> cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation \<and> carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr \<and> carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>) \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>) \<and> ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>) \<and> ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>) \<and> cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState \<sigma>) (globals x) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x) \<and> cte_array_relation \<sigma> (globals x) \<and> tcb_cte_array_relation \<sigma> (globals x) \<and> apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>) \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>) \<and> ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma> \<and> x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr \<and> {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs \<and> x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr \<and> {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs \<and> htd_safe domain (hrs_htd (t_hrs_' (globals x))) \<and> - domain \<subseteq> kernel_data_refs \<and> globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list \<and> cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule \<and> ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>) \<and> ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>) \<and> ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t)) \<and> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t)) \<and> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>) \<and> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>) \<and> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift t) tcb_ptr_to_ctcb_ptr ctcb_relation
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_queue_ptrs \<circ> cslift t = map_option tcb_null_queue_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; map_to_eps (ksPSpace \<sigma>) p = Some a; map_to_eps (ksPSpace \<sigma>) p = Some a'; cslift x (ep_Ptr p) = Some b; cslift x (ep_Ptr p) = Some b'\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift t) a' b'
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cendpoint_relation (cslift x) a b = cendpoint_relation (cslift t) a b
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (11 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> isWaitingNtfn (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr404 \<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 10. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` set (ntfnQueue (ntfnObj (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr404 \<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b\<rbrakk> \<Longrightarrow> ko_at' a (?epptr404 \<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; map_to_eps (ksPSpace \<sigma>) p = Some a; b' = b; cslift x (ep_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> ko_at' a (?epptr404 \<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b') (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ep_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> objBitsKO (injectKOS ntfn) = objBitsKO (KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ep_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> p \<noteq> ntfnptr
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' p a a' b b'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; a' = a; b' = b; cslift x (ep_Ptr p) = Some b; ko_at' a p \<sigma>\<rbrakk> \<Longrightarrow> p \<noteq> ntfnptr
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmap_relation (map_to_ntfns ((ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)))) ((cslift x)(ntfn_Ptr ntfnptr \<mapsto> ntfn')) ntfn_Ptr (cnotification_relation (cslift t))
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (10 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))\<rparr>))
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift t) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) ntfn'
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))) else {}))\<^esub>
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 10. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cnotification_relation (cslift t) (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn) ntfn'
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (9 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; notification_CL.state_CL (notification_lift ko') = 1; ep_queue_relation' (cslift x) x3 (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko'))); option_to_ctcb_ptr (ntfnBoundTCB ntfn) = tcb_Ptr (ntfnBoundTCB_CL (notification_lift ko'))\<rbrakk> \<Longrightarrow> (ntfnQueue_head_CL (notification_lift ko') = 0 \<longrightarrow> ep_queue_relation' (cslift t) (x3 @ [thread]) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4)) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4))) \<and> (ntfnQueue_head_CL (notification_lift ko') \<noteq> 0 \<longrightarrow> ep_queue_relation' (cslift t) (x3 @ [thread]) (tcb_Ptr (ntfnQueue_head_CL (notification_lift ko'))) (tcb_Ptr (ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4)))
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))) else {}))\<^esub>
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 9. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (8 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cslift t|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))) else {}))\<^esub> = cslift x|\<^bsub>(- tcb_ptr_to_ctcb_ptr ` (if isWaitingNtfn (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn)) then set (ntfnQueue (ntfnObj (ntfnObj_update (\<lambda>_. Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) ntfn))) else {}))\<^esub>
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 8. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift t) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>)
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (7 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> map_option tcb_null_ep_ptrs \<circ> cslift t = map_option tcb_null_ep_ptrs \<circ> cslift x
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 7. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (6 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> carch_state_relation (ksArchState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 6. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (5 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2, ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa)); cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace \<sigma>)) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace \<sigma>)) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace \<sigma>)) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace \<sigma>)) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace \<sigma>)) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace \<sigma>)) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace \<sigma>)) (c_h_t_valid x) pt_Ptr; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cmachine_state_relation (ksMachineState \<sigma>) (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)))\<rparr>)
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 5. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (4 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' val old ptr ptr' next. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> updateObject val old ptr ptr' next = updateObject_default val old ptr ptr' next
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 4. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (3 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 3. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (2 subgoals):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn' v v'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> objBits v = objBits v'
 2. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal (1 subgoal):
 1. \<And>\<sigma> x ko' t ta tb x3 tc notification ntfn'. \<lbrakk>valid_pspace' \<sigma>; sym_refs ((state_refs_of' \<sigma>)(ntfnptr := insert (thread, NTFNSignal) (set x3 \<times> {NTFNSignal} \<union> {r \<in> state_refs_of' \<sigma> ntfnptr. snd r = NTFNBound}))); st_tcb_at' (\<lambda>st. isBlockedOnNotification st \<and> waitingOnNotification st = ntfnptr) thread \<sigma>; ko_at' ntfn ntfnptr \<sigma>; (\<sigma>, x) \<in> rf_sr; cslift x (ntfn_Ptr ntfnptr) = Some ko'; cnotification_relation (cslift x) ntfn ko'; x \<Turnstile>\<^sub>c tcb_ptr_to_ctcb_ptr thread; tcb_at' thread \<sigma>; valid_ntfn' ntfn \<sigma>; is_aligned (ptr_val (tcb_ptr_to_ctcb_ptr thread)) ctcb_size_bits; sym_refs (state_refs_of' (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>)); ko_at' (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)) ntfnptr (\<sigma>\<lparr>ksPSpace := (ksPSpace \<sigma>)(ntfnptr \<mapsto> KONotification (NTFN (Structures_H.ntfn.WaitingNtfn (x3 @ [thread])) (ntfnBoundTCB ntfn)))\<rparr>); ntfnObj ntfn = Structures_H.ntfn.WaitingNtfn x3; thread \<notin> set x3; queue = x3 @ [thread]; head_C (ret__struct_tcb_queue_C_' t) = (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))); head_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_head_CL (notification_lift ko')); StateRelation_C.end_C (ret__struct_tcb_queue_C_' tc) = tcb_Ptr (ntfnQueue_tail_CL (notification_lift ko')); notification_lift notification = notification_lift ko'\<lparr>notification_CL.state_CL := 1 && mask 2\<rparr>; t_hrs_' (globals ta) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t)); notification_lift ntfn' = notification_lift (the (clift (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))) (ntfn_Ptr ntfnptr)))\<lparr>ntfnQueue_head_CL := ptr_val (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) && ~~ mask 4, ntfnQueue_tail_CL := ptr_val (tcb_ptr_to_ctcb_ptr thread) && ~~ mask 4\<rparr>; t_hrs_' (globals tb) = hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) ntfn') (hrs_mem_update (heap_update (ntfn_Ptr ntfnptr) notification) (t_hrs_' (globals t))); StateRelation_C.end_C (ret__struct_tcb_queue_C_' t) = tcb_ptr_to_ctcb_ptr thread; ep_queue_relation' (cslift t) (x3 @ [thread]) (if ntfnQueue_head_CL (notification_lift ko') = 0 then tcb_ptr_to_ctcb_ptr thread else tcb_Ptr (ntfnQueue_head_CL (notification_lift (the (cslift x (ntfn_Ptr ntfnptr)))))) (tcb_ptr_to_ctcb_ptr thread); cslift t|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub> = cslift x|\<^bsub>(- insert (tcb_ptr_to_ctcb_ptr thread) (tcb_ptr_to_ctcb_ptr ` set x3))\<^esub>; (\<lambda>x. map_option tcb_null_ep_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_ep_ptrs (cslift x xa)); cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; cslift t = cslift x; hrs_htd (t_hrs_' (globals t)) = hrs_htd (t_hrs_' (globals x)); \<forall>rs. zero_ranges_are_zero rs (t_hrs_' (globals x)) \<longrightarrow> zero_ranges_are_zero rs (t_hrs_' (globals t)); (\<lambda>x. map_option tcb_null_queue_ptrs (cslift t x)) = (\<lambda>xa. map_option tcb_null_queue_ptrs (cslift x xa))\<rbrakk> \<Longrightarrow> obj_at' (?P349 \<sigma> x ko' t ta tb x3 tc notification ntfn') ntfnptr \<sigma> proof (prove)
goal:
No subgoals!